meerkat-java/mixer/src/main/java/prover/Prover.java

package prover;

import com.google.protobuf.ByteString;
import com.google.protobuf.InvalidProtocolBufferException;
import meerkat.crypto.concrete.ECElGamalEncryption;
import meerkat.crypto.mixnet.Mix2ZeroKnowledgeProver;
import meerkat.protobuf.Crypto;
import meerkat.protobuf.Mixing;
import org.bouncycastle.math.ec.ECPoint;
import org.factcenter.qilin.primitives.RandomOracle;
import org.factcenter.qilin.primitives.concrete.ECGroup;

import java.math.BigInteger;
import java.util.Random;


/**
 * implements of Mix2ZeroKnowledgeProver interface
 * this implantation assumes that each RerandomizableEncryptedMessage is ElGamalCiphertext
 */
public class Prover implements Mix2ZeroKnowledgeProver {

    private final ECGroup group;
    private final RandomOracle randomOracle;
    private final Random rand;
    private final ECElGamalEncryption encryptor;
    private final ECPoint g,h;
    private final BigInteger groupOrderUpperBound;
    private final ElGamalProofOrganizer organizer;

    /**
     * @param rand
     * @param encryptor
     * @param randomOracle  - use for Fiat–Shamir heuristic
     */
    public Prover(Random rand,ECElGamalEncryption encryptor,RandomOracle randomOracle) {

        this.rand = rand;
        this.encryptor = encryptor;
        this.randomOracle = randomOracle;
        this.group = this.encryptor.getGroup();
        this.g = group.getGenerator();
        this.h = this.encryptor.getElGamalPK().getPK();
        this.organizer = new ElGamalProofOrganizer(group,g,h);
        this.groupOrderUpperBound  = group.orderUpperBound();
    }

    /**
     * @param in1
     * @param in2
     * @param out1  - if sw then out1 = rerandomize(in2,r2) else out1 = rerandomize(in1,r1)
     * @param out2  - if sw then out2 = rerandomize(in1,r1) else out1 = rerandomize(in2,r2)
     * @param sw    - flag
     * @param i     - column of in1 and out1 in encryption table
     * @param j     - column of in2 and out2 in encryption table
     * @param layer - row of in1,in2 in encryption table
     * @param r1
     * @param r2
     * @return      - a valid ZKP that indeed out1,out2 calculated as required
     * @throws InvalidProtocolBufferException
     */
    public Mixing.ZeroKnowledgeProof prove(Crypto.RerandomizableEncryptedMessage in1,
                                           Crypto.RerandomizableEncryptedMessage in2,
                                           Crypto.RerandomizableEncryptedMessage out1,
                                           Crypto.RerandomizableEncryptedMessage out2,
                                           boolean sw,int i,int j, int layer,
                                           Crypto.EncryptionRandomness r1,
                                           Crypto.EncryptionRandomness r2) throws InvalidProtocolBufferException {
        Mixing.ZeroKnowledgeProof.OrProof first,second,third,fourth;

        ElGamalProofOrganizer.ElGamalProofInput input = organizer.createProofInput(in1,in2,out1,out2,r1,r2,sw);

        first = createOrProofElGamal(input.getOrProofInput(ElGamalProofOrganizer.OrProofOrder.first));
        second = createOrProofElGamal(input.getOrProofInput(ElGamalProofOrganizer.OrProofOrder.second));
        third = createOrProofElGamal(input.getOrProofInput(ElGamalProofOrganizer.OrProofOrder.third));
        fourth = createOrProofElGamal(input.getOrProofInput(ElGamalProofOrganizer.OrProofOrder.fourth));

        Mixing.ZeroKnowledgeProof.Location location = Mixing.ZeroKnowledgeProof.Location.newBuilder()
                .setI(i)
                .setJ(j)
                .setLayer(layer)
                .build();

        Mixing.ZeroKnowledgeProof result = Mixing.ZeroKnowledgeProof.newBuilder()
                .setFirst(first)
                .setSecond(second)
                .setThird(third)
                .setFourth(fourth)
                .setLocation(location)
                .build();
        return  result;
    }


    /**
     * Fiat–Shamir heuristic
     * @param input - protobuf contains all parameters from the first step of the current prove
     * @return randomOracle.hash(input)
     */
    private BigInteger hash(Mixing.ZeroKnowledgeProof.OrProof.ForRandomOracle input) {
        byte[] arr = input.toByteArray();
        return new BigInteger(1,this.randomOracle.hash(arr,arr.length));
    }


    /**
     * @param orProofInput
     * @return ZKP OrProof: there exists x s.t (g1 ^ x == h1 and g2 ^ x == h2) or (g1' ^ x == h1 and g2' ^ x == h2)
     *         assuming DLog is hard in this.group then that proves x is known for the prover
     */
    private Mixing.ZeroKnowledgeProof.OrProof createOrProofElGamal(ElGamalProofOrganizer.OrProofInput orProofInput) {

        ECPoint g1 = orProofInput.g1;
        ECPoint h1 = orProofInput.h1;
        ECPoint g2 = orProofInput.g2;
        ECPoint h2 = orProofInput.h2;

        ECPoint g1Tag  = orProofInput.g1Tag;
        ECPoint h1Tag  = orProofInput.h1Tag;
        ECPoint g2Tag  = orProofInput.g2Tag;
        ECPoint h2Tag  = orProofInput.h2Tag;

        BigInteger r = encryptor.extractRandomness(encryptor.generateRandomness(rand)).mod(groupOrderUpperBound);
        BigInteger c1,c2,z,zTag;
        ECPoint u,v,uTag,vTag;
        Mixing.ZeroKnowledgeProof.OrProof.ForRandomOracle forRandomOracle;


        switch (orProofInput.flag) {
            case left:
                c2 = encryptor.extractRandomness(encryptor.generateRandomness(rand)).mod(groupOrderUpperBound);
                zTag = encryptor.extractRandomness(encryptor.generateRandomness(rand)).mod(groupOrderUpperBound);
                //step 1
                u = group.multiply(g1, r);
                v = group.multiply(g2, r);
                uTag = group.add(group.multiply(g1Tag, zTag), group.negate(group.multiply(h1Tag, c2)));
                vTag = group.add(group.multiply(g2Tag, zTag), group.negate(group.multiply(h2Tag, c2)));
                //step 2
                // c1 = (hash(input + step1) + group size - c2)% group size
                forRandomOracle =
                        Mixing.ZeroKnowledgeProof.OrProof.ForRandomOracle.newBuilder()
                                .setG1(ByteString.copyFrom(orProofInput.g1Encoded))
                                .setH1(ByteString.copyFrom(orProofInput.h1Encoded))
                                .setG2(ByteString.copyFrom(orProofInput.g2Encoded))
                                .setH2(ByteString.copyFrom(orProofInput.h2Encoded))
                                .setG1Tag(ByteString.copyFrom(orProofInput.g1TagEncoded))
                                .setH1Tag(ByteString.copyFrom(orProofInput.h1TagEncoded))
                                .setG2Tag(ByteString.copyFrom(orProofInput.g2TagEncoded))
                                .setH2Tag(ByteString.copyFrom(orProofInput.h2TagEncoded))
                                .setU(ByteString.copyFrom(group.encode(u)))
                                .setV(ByteString.copyFrom(group.encode(v)))
                                .setUTag(ByteString.copyFrom(group.encode(uTag)))
                                .setVTag(ByteString.copyFrom(group.encode(vTag)))
                                .build();
                c1 = hash(forRandomOracle).add(group.orderUpperBound().subtract(c2)).mod(groupOrderUpperBound);
                //step 3
                //z = (r +  c1 * x) % group size;
                z = r.add(c1.multiply(encryptor.extractRandomness(orProofInput.x))).mod(groupOrderUpperBound);
                break;
            case right:
                c1 = encryptor.extractRandomness(encryptor.generateRandomness(rand)).mod(groupOrderUpperBound);
                z = encryptor.extractRandomness(encryptor.generateRandomness(rand)).mod(groupOrderUpperBound);
                //step 1
                uTag = group.multiply(g1Tag, r);
                vTag = group.multiply(g2Tag, r);
                u = group.add(group.multiply(g1, z), group.negate(group.multiply(h1, c1)));
                v = group.add(group.multiply(g2, z), group.negate(group.multiply(h2, c1)));
                //step 2
                // c1 = (hash(input + step1) + group size - c1)% group size
                forRandomOracle =
                        Mixing.ZeroKnowledgeProof.OrProof.ForRandomOracle.newBuilder()
                                .setG1(ByteString.copyFrom(orProofInput.g1Encoded))
                                .setH1(ByteString.copyFrom(orProofInput.h1Encoded))
                                .setG2(ByteString.copyFrom(orProofInput.g2Encoded))
                                .setH2(ByteString.copyFrom(orProofInput.h2Encoded))
                                .setG1Tag(ByteString.copyFrom(orProofInput.g1TagEncoded))
                                .setH1Tag(ByteString.copyFrom(orProofInput.h1TagEncoded))
                                .setG2Tag(ByteString.copyFrom(orProofInput.g2TagEncoded))
                                .setH2Tag(ByteString.copyFrom(orProofInput.h2TagEncoded))
                                .setU(ByteString.copyFrom(group.encode(u)))
                                .setV(ByteString.copyFrom(group.encode(v)))
                                .setUTag(ByteString.copyFrom(group.encode(uTag)))
                                .setVTag(ByteString.copyFrom(group.encode(vTag)))
                                .build();
                c2 = hash(forRandomOracle).add(group.orderUpperBound().subtract(c1)).mod(groupOrderUpperBound);
                //step 3
                //zTag = (r +  c2 * x) % group size;
                zTag = r.add(c2.multiply(encryptor.extractRandomness(orProofInput.x))).mod(groupOrderUpperBound);
                break;
            default:
                return null;
        }


        return Mixing.ZeroKnowledgeProof.OrProof.newBuilder()
                .setG1(forRandomOracle.getG1())
                .setH1(forRandomOracle.getH1())
                .setG2(forRandomOracle.getG2())
                .setH2(forRandomOracle.getH2())
                .setG1Tag(forRandomOracle.getG1())
                .setH1Tag(forRandomOracle.getH1Tag())
                .setG2Tag(forRandomOracle.getG2Tag())
                .setH2Tag(forRandomOracle.getH2Tag())
                .setU(forRandomOracle.getU())
                .setV(forRandomOracle.getV())
                .setUTag(forRandomOracle.getUTag())
                .setVTag(forRandomOracle.getVTag())
                .setC1(ByteString.copyFrom(c1.toByteArray()))
                .setC2(ByteString.copyFrom(c2.toByteArray()))
                .setZ(ByteString.copyFrom(z.toByteArray()))
                .setZTag(ByteString.copyFrom(zTag.toByteArray()))
                .build();
    }
}