qoneway

Documentation

Index

• func ProveBitCommitment() (bool, error)
• func ProveMultiplicationCommitment() (bool, error)
• type Committer
  • func NewCommitter(qOneWay *RSABased, y *big.Int) (*Committer, error)
  • func (c *Committer) GetCommitMsg(a *big.Int) (*big.Int, error)
  • func (c *Committer) GetCommitmentToMultiplication(a, b, u *big.Int) (*big.Int, *big.Int, *big.Int)
  • func (c *Committer) GetDecommitMsg() (*big.Int, *big.Int)
• type MultiplicationProver
  • func NewMultiplicationProver(homomorphism func(*big.Int) *big.Int, homomorphismInv func(*big.Int) *big.Int, ...) *MultiplicationProver
  • func (p *MultiplicationProver) GetProofData(challenge *big.Int) (*big.Int, *big.Int, *big.Int, *big.Int, *big.Int)
  • func (p *MultiplicationProver) GetProofRandomData() (*big.Int, *big.Int, *big.Int)
• type MultiplicationVerifier
  • func NewMultiplicationVerifier(homomorphism func(*big.Int) *big.Int, H crypto.Group, Q, Y *big.Int, ...) *MultiplicationVerifier
  • func (v *MultiplicationVerifier) GetChallenge() *big.Int
  • func (v *MultiplicationVerifier) SetProofRandomData(m1, m2, m3 *big.Int)
  • func (v *MultiplicationVerifier) Verify(z1, w1, w2, z2, w3 *big.Int) bool
• type RSABased
  • func NewRSABased(bitLen int) (*RSABased, error)
• type Receiver
  • func NewReceiver(nBitLength int) (*Receiver, error)
  • func (r *Receiver) CheckDecommitment(R, a *big.Int) bool
  • func (r *Receiver) SetCommitment(c *big.Int)

Functions

func ProveBitCommitment

func ProveBitCommitment() (bool, error)

ProveBitCommitment demonstrates how committer can prove that a commitment contains 0 or 1. This is achieved by using PartialPreimageProver.

func ProveMultiplicationCommitment

func ProveMultiplicationCommitment() (bool, error)

ProveMultiplicationCommitment demonstrates how, given commitments A, B, C, prover can prove that C = A * B. Note that the proof should work also for other commitments that are based on q-one-way Homomorphism, not only for our RSA-based Committer.

Types

type Committer

type Committer struct {
	*RSABased
	Y *big.Int
	// contains filtered or unexported fields
}

Committer implements commitment scheme based on RSA based q-one-way Group Homomorphism (scheme proposed by Cramer and Damgard). Commitment schemes based on q-one-way Homomorphism have some nice properties - it can be proved in zero knowledge that a commitment contains 0 or 1 (see ProveBitCommitment) and it can be proved for A, B, C that C is commitment for a * b where A is commitment to a and B commitment to B.

func NewCommitter

func NewCommitter(qOneWay *RSABased, y *big.Int) (*Committer, error)

NewCommitter takes qOneWay and y generated by the Receiver.

func (*Committer) GetCommitMsg

func (c *Committer) GetCommitMsg(a *big.Int) (*big.Int, error)

func (*Committer) GetCommitmentToMultiplication

func (c *Committer) GetCommitmentToMultiplication(a, b, u *big.Int) (*big.Int,
	*big.Int, *big.Int)

GetCommitmentToMultiplication receives a, b, u where u is a random integer used in commitment B to b (B = y^b * QOneWayHomomorphism(u)). It returns commitment C to c = a * b mod Q, random integer o where C = y^(a*b) * QOneWayHomomorphism(o), and integer t such that C = B^a * QOneWayHomomorphism(t).

func (*Committer) GetDecommitMsg

func (c *Committer) GetDecommitMsg() (*big.Int, *big.Int)

type MultiplicationProver

type MultiplicationProver struct {
	QOneWayHomomorphism    func(*big.Int) *big.Int
	QOneWayHomomorphismInv func(*big.Int) *big.Int // works only for y^Q, takes y as input
	H                      crypto.Group
	Q                      *big.Int
	Y                      *big.Int
	A                      *big.Int // commitments to a
	B                      *big.Int // commitment to b
	C                      *big.Int // commitment to c = a * b mod Q
	// contains filtered or unexported fields
}

func NewMultiplicationProver

func NewMultiplicationProver(homomorphism func(*big.Int) *big.Int,
	homomorphismInv func(*big.Int) *big.Int,
	H crypto.Group, Q, Y *big.Int, commitments *common.Triple, committedValues *common.Pair,
	randomValues *common.Triple, t *big.Int) *MultiplicationProver

func (*MultiplicationProver) GetProofData

func (p *MultiplicationProver) GetProofData(challenge *big.Int) (*big.Int, *big.Int,
	*big.Int, *big.Int, *big.Int)

func (*MultiplicationProver) GetProofRandomData

func (p *MultiplicationProver) GetProofRandomData() (*big.Int, *big.Int, *big.Int)

type MultiplicationVerifier

type MultiplicationVerifier struct {
	QOneWayHomomorphism func(*big.Int) *big.Int
	H                   crypto.Group
	Q                   *big.Int
	Y                   *big.Int
	A                   *big.Int
	B                   *big.Int
	C                   *big.Int
	// contains filtered or unexported fields
}

func NewMultiplicationVerifier

func NewMultiplicationVerifier(homomorphism func(*big.Int) *big.Int, H crypto.Group,
	Q, Y *big.Int, commitments *common.Triple) *MultiplicationVerifier

func (*MultiplicationVerifier) GetChallenge

func (v *MultiplicationVerifier) GetChallenge() *big.Int

func (*MultiplicationVerifier) SetProofRandomData

func (v *MultiplicationVerifier) SetProofRandomData(m1, m2, m3 *big.Int)

func (*MultiplicationVerifier) Verify

func (v *MultiplicationVerifier) Verify(z1, w1, w2, z2, w3 *big.Int) bool

type RSABased

type RSABased struct {
	Group *rsa.Group
	// Q is a random number > Group.N.
	Q *big.Int
	// Homomorphism is q-one-way Homomorphism f: x -> x^Q mod N.
	// It is difficult to compute a preimage of y^i for i < Q, but easy for i = Q.
	// Computing preimage of y^Q for RSA-based q-one-way is trivial: it is y.
	Homomorphism func(*big.Int) *big.Int
	// HomomorphismInv can compute x such that Homomorphism(x) = y^Q, given y^Q.
	// Note: we assume that HomomorphismInv takes y as input, not y^Q.
	// In our case (RSA-based q-one-way), HomomorphismInv is trivial: identity.
	// For other QOneHomomorphisms it might be different.
	HomomorphismInv func(*big.Int) *big.Int
}

RSABased represents RSA-based q-one-way.

func NewRSABased

func NewRSABased(bitLen int) (*RSABased, error)

NewRSABased generates a new instance of RSABased q-one-way. It takes bit length for instantiating the underlying rsa.Group.

type Receiver

type Receiver struct {
	*RSABased
	Y *big.Int
	// contains filtered or unexported fields
}

func NewReceiver

func NewReceiver(nBitLength int) (*Receiver, error)

func (*Receiver) CheckDecommitment

func (r *Receiver) CheckDecommitment(R, a *big.Int) bool

func (*Receiver) SetCommitment

func (r *Receiver) SetCommitment(c *big.Int)

When receiver receives a commitment, it stores the value using SetCommitment method.