Remove simulation from LinearRelation
MODIFY
WalletWasabi.Tests/UnitTests/Crypto/ZeroKnowledge/LinearRelationTests.cs
WalletWasabi.Tests/UnitTests/Crypto/ZeroKnowledge/LinearRelationTests.cs
@@ -22,7 +22,7 @@ namespace WalletWasabi.Tests.UnitTests.Crypto.ZeroKnowledge
[InlineData(short.MaxValue, uint.MaxValue)]
[InlineData(int.MaxValue, uint.MaxValue)]
[InlineData(uint.MaxValue, uint.MaxValue)]
- public void VerifyResponsesAndSimulations(uint scalarSeed1, uint scalarSeed2)
+ public void VerifyResponses(uint scalarSeed1, uint scalarSeed2)
{
var witness = new ScalarVector(new Scalar(scalarSeed1), new Scalar(scalarSeed2));
var generators = new GroupElementVector(Generators.G, Generators.Ga);
@@ -37,36 +37,14 @@ namespace WalletWasabi.Tests.UnitTests.Crypto.ZeroKnowledge
var response = equation.Respond(witness, secretNonces, challenge);
Assert.True(equation.Verify(publicNonce, challenge, response));
- // Even without a witness, simulated proofs with the same response should still verify
- var simulatedNonce = equation.Simulate(challenge, response);
- Assert.True(equation.Verify(simulatedNonce, challenge, response));
-
- // And the simulated prover commitment should be the same as the real one
- // even if its discrete log w.r.t. the generators is not known
- Assert.True(simulatedNonce == publicNonce);
-
// With a different challenge the nonce should be different
// unless the secret is 0, due to the absorption property
var otherChallenge = new Scalar(103);
- var otherSimulatedNonce = equation.Simulate(otherChallenge, response);
- Assert.True(equation.Verify(otherSimulatedNonce, otherChallenge, response));
- if (scalarSeed1 != 0 && scalarSeed2 != 0)
- {
- Assert.True(otherSimulatedNonce != publicNonce);
- }
-
- // And with a different response the verifier should still accept
- var otherResponse = new ScalarVector(new Scalar(2), new Scalar(3));
- var thirdSimulatedNonce = equation.Simulate(challenge, otherResponse);
- Assert.True(equation.Verify(thirdSimulatedNonce, challenge, otherResponse));
- Assert.True(thirdSimulatedNonce != otherSimulatedNonce);
- Assert.True(thirdSimulatedNonce != publicNonce);
// The verifying should reject invalid transcripts, and this also requires
// an exception for when the public input is the point at infinity
if (scalarSeed1 != 0 && scalarSeed2 != 0)
{
- Assert.False(equation.Verify(simulatedNonce, otherChallenge, response));
Assert.False(equation.Verify(publicNonce, otherChallenge, response));
}
}
@@ -120,16 +98,7 @@ namespace WalletWasabi.Tests.UnitTests.Crypto.ZeroKnowledge
new Equation(b, new GroupElementVector(Generators.Gh))
);
- // Check that simulation produces valid transcripts
var challenge = new Scalar(13);
- var simulatedResponses = new[]
- {
- new ScalarVector(Scalar.One),
- new ScalarVector(Scalar.One),
- };
-
- var simulatedPublicNonces = statement.SimulatePublicNonces(challenge, simulatedResponses);
- Assert.True(statement.CheckVerificationEquation(simulatedPublicNonces, challenge, simulatedResponses));
// Create transcripts using a witness to the relation
var knowledge = new Knowledge(statement, new ScalarVector(x));
@@ -140,8 +109,6 @@ namespace WalletWasabi.Tests.UnitTests.Crypto.ZeroKnowledge
// Ensure that verifier rejects invalid transcripts
Assert.False(statement.CheckVerificationEquation(publicNonces, new Scalar(17), allResponses));
- Assert.False(statement.CheckVerificationEquation(simulatedPublicNonces, challenge, allResponses));
- Assert.False(statement.CheckVerificationEquation(publicNonces, challenge, simulatedResponses));
}
[Fact]

MODIFY
WalletWasabi/Crypto/ZeroKnowledge/LinearRelation/Equation.cs
WalletWasabi/Crypto/ZeroKnowledge/LinearRelation/Equation.cs
@@ -49,15 +49,6 @@ namespace WalletWasabi.Crypto.ZeroKnowledge.LinearRelation
return responses * Generators == (publicNonce + challenge * PublicPoint);
}
- // Simulate a public nonce given a challenge and arbitrary responses (should be random)
- internal GroupElement Simulate(Scalar challenge, ScalarVector givenResponses)
- {
- // The verification equation above can be rearranged as a formula for R
- // given e, P and s by subtracting eP from both sides:
- // R = sG - eP
- return givenResponses * Generators - challenge * PublicPoint;
- }
-
// Given a witness and secret nonces, respond to a challenge proving the equation holds w.r.t the witness
internal ScalarVector Respond(ScalarVector witness, ScalarVector secretNonces, Scalar challenge)
{

MODIFY
WalletWasabi/Crypto/ZeroKnowledge/LinearRelation/Statement.cs
WalletWasabi/Crypto/ZeroKnowledge/LinearRelation/Statement.cs
@@ -3,7 +3,6 @@ using System.Collections.Generic;
using System.Linq;
using WalletWasabi.Crypto.Groups;
using WalletWasabi.Helpers;
-using WalletWasabi.Crypto.ZeroKnowledge;
namespace WalletWasabi.Crypto.ZeroKnowledge.LinearRelation
{
@@ -49,13 +48,5 @@ namespace WalletWasabi.Crypto.ZeroKnowledge.LinearRelation
return Equations.Zip(publicNonces, allResponses, (equation, r, s) => equation.Verify(r, challenge, s)).All(x => x);
}
-
- public GroupElementVector SimulatePublicNonces(Scalar challenge, IEnumerable<ScalarVector> allGivenResponses)
- {
- // The responses matrix should match the generators in the equations and
- Equations.CheckDimensions(allGivenResponses);
-
- return new GroupElementVector(Enumerable.Zip(Equations, allGivenResponses, (e, r) => e.Simulate(challenge, r)));
- }
}
}

Remove simulation from LinearRelation