Skip to content

Commit 88d2047

Browse files
authored
Merge pull request #26 from input-output-hk/curiecrypt/documentation
Documentation of atms prover
2 parents a902185 + e6843b8 commit 88d2047

35 files changed

+1164
-134
lines changed

prover/Cargo.toml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,6 @@ criterion = "0.5.1"
3232
[[bench]]
3333
name = "atms"
3434
harness = false
35+
36+
[package.metadata.docs.rs]
37+
rustdoc-args = [ "--html-in-header", "katex-header.html" ]

prover/README.md

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
# SNARK-based ATMS
2+
This is the circuit implementation for [Ad-hoc Threshold MultiSignatures (ATMS)](https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8835275).
3+
The goal of this library is to provide a proof-of-concept implementation of a circuit to provide a proof that there exists `t` valid signatures of some subset of a given set of public keys.
4+
This is the first effort of implementing a SNARK-based Ad-hoc Threshold Multi Signature scheme.
5+
6+
* The Zero Knowledge Proving system is implemented with PLONK with KZG commitments.
7+
* BLS12-381 curve is used. Therefore, in-circuit elliptic curve operations are implemented with JubJub, which is an elliptic curve defined over the Scalar field of BLS12-381, aka its 'embedded' curve. This enables what is sometimes referred to as SNARK-friendly signature schemes. In particular, Schnorr over the JubJub curve.
8+
* As a SNARK-friendly hash algorithm we use Rescue, both for the signature generation/verification as for the Merkle Tree commitments.
9+
110
## Compiling the library and header file
211
First, one needs to compile the library running:
312
```shell
@@ -15,16 +24,14 @@ and then build the header file by running the following command from the parent
1524
rustup run nightly cbindgen ./ --config cbindgen.toml --crate atms-halo2 --output target/include/atms_halo2.h
1625
```
1726

18-
## Running C tests
19-
20-
We first build the test executable:
21-
22-
``` sh
23-
gcc -Wl,-dead_strip c-tests/atms_halo2.c -g -o test -L ./target/release -latms_halo2 -lstdc++
24-
```
25-
26-
then simply run the tests:
27+
## Documentation
28+
The library provides a documentation for ATMS functionality. $\rightarrow$ [Documentation][crate::docs].
2729

28-
```shell
29-
./test
30-
```
30+
You can also jump to following sections from following links:
31+
- Elliptic curve cryptography preliminaries: [ECC][crate::docs::ecc]
32+
- Schnorr signature: [Schnorr][crate::docs::schnorr]
33+
- Ad-hoc threshold multi-signature: [ATMS][crate::docs::atms]
34+
- Rescue sponge hash function: [Rescue][crate::docs::rescue]
35+
- I/O specs and encoding: [I/O][crate::docs::encoding_io]
36+
- Flow of the functionality: [flow][crate::docs::flow]
37+
- Relation between the cryptographic primitives: [primitives][crate::docs::primitives]

prover/docs/atms-primitives.md

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
Relation between the elliptic curves and signature schemes.
2+
3+
In order to comply with the Cardano main-net, Curve BLS12-381 is used as the parent curve in this library.
4+
Therefore, the rest of the primitives are selected considering this case.
5+
In-circuit elliptic curve operations are implemented with Jubjub curve.
6+
Jubjub is the embedded curve of BLS12-381.
7+
We used a SNARK-friendly signature scheme, Schnorr over Jubjub.
8+
9+
In this section, we explain the relation between BLS12-381, Jubjub, Schnorr, and EdDSA.
10+
11+
See the documentation of the related topics:
12+
- [BLS12-381][crate::docs::ecc#curve-setting]
13+
- [JubJub][crate::docs::ecc#jubjub]
14+
- [EdDSA][crate::docs::ecc#edwards-curve-digital-signature-algorithm-eddsa]
15+
- [Schnorr][crate::docs::schnorr]
16+
17+
## Relation between BLS12-381 and Jubjub
18+
BLS12-381 is preferred for pairing operations.
19+
We define two curves:
20+
- Curve 1: Defined over the field $\mathbb{F}_p$. The curve equation is given below:
21+
$$E(\mathbb{F}_p): y^2 = x^3 + 4$$
22+
23+
- Curve 2: Defined over the field $\mathbb{F}_{p^2}$. The curve equation is given below:
24+
25+
$$E'(\mathbb{F}_{p^2}): y^2 = x^3 + 4 (1 + i)$$
26+
27+
The prime $p$ is represented in hexadecimal as following:
28+
```ignore
29+
0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
30+
```
31+
32+
Pairings are usually denoted as $e(P, Q)$ where
33+
* $e: G_1 \times G_2 \rightarrow G_T$
34+
* $P \in G_1 \sub E(\mathbb{F}_p)$
35+
* $Q \in G_2 \sub E'(\mathbb{F}_{p^2})$
36+
* $G_T \sub \mathbb{F}_{p^{12}}$
37+
38+
As described in [here][crate::docs::ecc#pairing], the following identity holds:
39+
$$e(\[a\]P, \[b\]Q) = e(P, \[b\]Q)^a = e(P, Q)^{ab} = e(P, \[a\]Q)b = e(\[b\]P, \[a\]Q).$$
40+
41+
Note that, in the above identity, we showed some scalar multiplications, i.e., $\[a\]P$.
42+
The value $a$ is an element of $\mathbb{F}_s$,
43+
where $s$ is the size of the subgroup of the curve.
44+
$\mathbb{F}_s$ is a finite field defined over the prime $s$, which is represented in hexadecimal as follows:
45+
```ignore
46+
0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
47+
```
48+
(_For sake of simplicity, we won't explain the details of the mentioned subgroup._)
49+
50+
> As a conclusion, we say that the base field of BLS12-381 is $\mathbb{F}_p$ and the scalar field of the curve is $\mathbb{F}_s$.
51+
52+
Our second primitive is the Jubjub curve.
53+
Jubjub is an elliptic curve of the [twisted Edward's form][crate::docs::ecc#twisted-edwards-curve].
54+
55+
Let $d = -(10240/10241)$, the Jubjub curve is defined as follows:
56+
$$E_{d}: -u^2 + v^2 = 1 + du^2v^2.$$
57+
We use Jubjub for in-circuit elliptic curve operations since it provides efficient EC operations within the proof.
58+
We define the Jubjub curve over the field $\mathbb{F}_q$ where $q$ is represented in hexadecimal as follows:
59+
```ignore
60+
q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
61+
```
62+
In addition, it has a subgroup of order $r$ and cofactor $8$.
63+
```ignore
64+
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
65+
```
66+
As mentioned before, we set the Jubjub curve as the embedded curve of BLS12-381.
67+
Meaning that, Jubjub curve is defined over a prime which is also the prime that defines the scalar field of BLS12-381.
68+
69+
> As a conclusion, we say that the base field of Jubjub is $\mathbb{F}_q$ and the scalar field of the curve is $\mathbb{F}_r$.
70+
71+
---
72+
73+
**Note that, the scalar field of BLS12-381 $\mathbb{F}_s$ equals to the base field of Jubjub $\mathbb{F}_q$.**
74+
**It means that if I have a result on the base field of the JubJub curve, it is also an element of the scalar field of the BLS curve.**
75+
76+
---
77+
78+
## Relation between Schnorr signature and EdDSA
79+
EdDSA is a variant of the Schnorr signature scheme designed specifically for Edward's curve.
80+
See the [$sign$][crate::docs::schnorr#sign] algorithm of Schnorr and the [sign][crate::docs::ecc#sign] algorithm of EdDSA.
81+
Note that, the only difference between two algorithms is the first step.
82+
* In Schnorr signature, we have:
83+
* Choose a random scalar: $r \leftarrow Z_p$,
84+
* Compute the nonce: $R = r \cdot G$.
85+
* In EdDSA, we have:
86+
* Get the hash of private key and the message: $r = H(H_{b, \ldots, 2b-1}(x) || m)$.
87+
* Compute the point $R = r \cdot B$.
88+
89+
This means that the randomness used in the first step of the Schnorr signer is generated using a hash function by the EdDSA signer, rather than sampling the value at random.
90+
91+
* We use the probabilistic Schnorr signature scheme in our setting. We can make this deterministic using EdDSA instead.
92+
93+
## Relation between BLS12-381, Jubjub, and Schnorr
94+
To implement the Schnorr signature, we use elliptic curve scalar multiplications.
95+
_(See [$Schnorr signature$][crate::docs::schnorr]) and [scalar multiplication][crate::docs::ecc#basic-ecc-toolbox].)_
96+
* In this library, the scalar multiplication is implemented as follows:
97+
* Let $a$ be scalar and an element of the scalar field of Jubjub curve.
98+
* $a \in \mathbb{F}_r$
99+
* Let $P$ be an extended point on Jubjub curve. Meaning that, the coordinates of the point are elements of the base field of the Jubjub curve, $\mathbb{F}_q$.
100+
* $Q = a \cdot P$ is the result of the scalar multiplication and is an extended point on Jubjub curve.
101+
* Convert $Q$ to an affine point. The coordinates of an affine point are elements of the base field of the Jubjub curve, $\mathbb{F}_q$.
102+
103+
> As a conclusion, we can say that the coordinates of both affine and extended points in the above scheme are also elements of the scalar field of BLS12-381 curve.

prover/docs/docs-ecc.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
# ECC Preliminaries
2+
This module includes a brief explanation of the elliptic curve cryptography primitives used in the library.
3+
- [Basic ECC Toolbox][crate::docs::ecc#basic-ecc-toolbox]
4+
- [Twisted Edward's Curve][crate::docs::ecc#twisted-edwards-curve]
5+
- [EdDSA][crate::docs::ecc#eddsa---edwards-curve-digital-signature-algorithm]
6+
- [BLS12-381][crate::docs::ecc#bls12-381]
7+
- [Pairings][crate::docs::ecc#pairing]
8+
- [Jubjub][crate::docs::ecc#jubjub]
9+
10+
## Basic ECC Toolbox
11+
- $p$: a large prime number.
12+
- $\mathbb{F}_p$: Finite field over prime $p$.
13+
- $E(\mathbb{F}_p): y^2=x^3+ax+b$: is an elliptic curve of the short Weierstrass form defined over $\mathbb{F}_p$.
14+
- $P = (x, y)$ is a point on $E(\mathbb{F}_p)$.
15+
- $-P = (x, -y)$ is the negative of the point $P$.
16+
- $P + (-P) = \mathcal{O}$ is the identity of the curve.
17+
- $P + \mathcal{O} = P$.
18+
- Elliptic curve scalar multiplication:
19+
- Let $n \leftarrow \mathbb{Z}_p$,
20+
- Let $P$ be a point on $E(\mathbb{F}_p)$,
21+
- $Q = n \cdot P$ is a point on $E(\mathbb{F}_p)$.
22+
- Elliptic curve discrete logarithm problem:
23+
- Let $P$ and $Q$ be points on $E(\mathbb{F}_p)$ and $Q = n \cdot P$.
24+
- Knowing $P$ and $Q$, finding $n = \log_P^Q$ is a hard problem.
25+
- Base point: Let $G$ be a base point, then $G$ generates all points at $E(\mathbb{F}_p)$.
26+
- Order of a point: If $l\cdot P = \mathcal{O}$, then $l$ is the order of $P$.
27+
28+
## Twisted Edward's Curve
29+
Let $\mathbb{F}_p$ be a field where $p$ is a large prime. The twisted Edward's curve is defined as follows:
30+
31+
$$ E_{E, a, d}: ax^2 + y^2 = 1 + dx^2y^2$$
32+
33+
where $a, d \in \mathbb{F}_p$ and non-zero.
34+
35+
* A point on $E_{E, a, d}$ is represented as $P = (x, y)$.
36+
* Negative of a point: $-P = (-x, y)$.
37+
* Neutral element(point at infinity): $\mathcal{O} = (0,1)$.
38+
* Let $P = (x_1, y_1)$ and $Q = (x_2, y_2)$ be points on $E_{E, a, d}$. $P+Q = (x_3, y_3)$ is written as:
39+
40+
$$(x_3, y_3) = \Bigg(\frac{x_1y_2 + y_1x_2}{1 + dx_1x_2y_1y_2}, \frac{y_1y_2 - ax_1x_2}{1 - dx_1x_2y_1y_2}\Bigg).$$
41+
42+
43+
### EdDSA - (Edward's Curve Digital Signature Algorithm)
44+
Let $B$ be the base point of $E_{E, a, d}$ with order $l$ and $H$ be a hash function with $2b-$bit output size where $2^{b-1} > p$.
45+
* $keygen$
46+
* **Input**: Security parameter $\lambda$.
47+
* **Output**: Keypair $(x, P)$.
48+
* **Algorithm**:
49+
* Choose a random scalar as the private key: $x \leftarrow \mathbb{Z}_p$,
50+
* Compute the public key: $P \leftarrow x \cdot B$,
51+
* Return $(x, P)$.
52+
* $sign$
53+
* **Input**: Keypair $(x, P)$, message $m$.
54+
* **Output**: Signature $\sigma = (R, s)$.
55+
* **Algorithm**:
56+
* Get the hash of private key and the message: $r = H(H_{b, \ldots, 2b-1}(x) || m)$.
57+
* Compute the point $R = r \cdot B$.
58+
* Calculate $s \equiv r + H(R || P|| m) x \mod{l}$.
59+
* Return $(R, s)$.
60+
* $verify$
61+
* **Input**: Message $m$, public key $P$, signature $\sigma = (R, s)$.
62+
* **Output**: $true/false$
63+
* **Algorithm**:
64+
* If $s \cdot B = R + H(R || P|| m) \cdot P$, return $true$.
65+
* Else, return $false$.
66+
67+
68+
---
69+
70+
71+
## BLS12-381
72+
73+
### Curve setting
74+
* `z = -0xd201000000010000` (hexadecimal): low hamming weight, few bits set to $1$.
75+
* Field modulus: $q = \frac{1}{3}(z-1)^2(z^4 - z^2 + 1) + z$, $381$-bit
76+
```ignore
77+
0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
78+
```
79+
* Subgroup size: $r = (z^4 - z^2 + 1)$, $255$-bit.
80+
```ignore
81+
0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
82+
```
83+
* **Curve 1:** $E(\mathbb{F}_q): y^2 = x^3 + 4$.
84+
* **Curve 2:** $E'(\mathbb{F}_{q^2}): y^2 = x^3 + 4 (1 + i)$.
85+
86+
### Pairing
87+
A pairing is a bilinear map, taking as input two points, each from two distinct groups of the same prime order, $r$. This map outputs a point from a group $G_T$. The pairing is defined as follows:
88+
89+
$$e: G_1 \times G_2 \rightarrow G_T$$
90+
91+
* $P \in G_1 \sub E(\mathbb{F}_q)$
92+
* $Q \in G_2 \sub E'(\mathbb{F}_{q^2})$
93+
* $G_T \sub \mathbb{F}_{q^{12}}$
94+
95+
Pairing is denoted as $e(P, R)$. Pairing-based cryptography uses the following properties:
96+
* $e(P, Q+R) = e(P, Q) \cdot e(P, R)$,
97+
* $e(P+S, R) = e(P, R) \cdot e(S, R)$.
98+
99+
Thus, the following identity holds:
100+
101+
$$e(\[a\]P, \[b\]Q) = e(P, \[b\]Q)^a = e(P, Q)^{ab} = e(P, \[a\]Q)b = e(\[b\]P, \[a\]Q).$$
102+
103+
104+
## jubjub
105+
106+
Jubjub is an elliptic curve of the twisted Edward's form. It is defined over finite field $\mathbb{F}_q$ where
107+
```ignore
108+
q = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
109+
```
110+
with a subgroup of order $r$ and cofactor $8$.
111+
```ignore
112+
r = 0x0e7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7
113+
```
114+
Let $d = -(10240/10241)$, the Jubjub curve is defined as follows:
115+
116+
$$E_{d}: -u^2 + v^2 = 1 + du^2v^2.$$
117+
118+
* $\mathbb{F}_q$ is chosen to be the scalar field of BLS12-381 curve construction.

0 commit comments

Comments
 (0)