Refactoring randomization and suggestions CR
MODIFY
WalletWasabi.Tests/UnitTests/Crypto/ProofSystemTests.cs
WalletWasabi.Tests/UnitTests/Crypto/ProofSystemTests.cs
@@ -65,12 +65,9 @@ namespace WalletWasabi.Tests.UnitTests.Crypto
var r = rnd.GetScalar();
var a = rnd.GetScalar();
- static (GroupElement Ca, GroupElement S) SerialNumberPublicPoints(Scalar z, Scalar a, Scalar r) =>
- (z * Generators.Ga + r * Generators.Gh + a * Generators.Gg, r * Generators.Gs);
-
{
var witness = new ScalarVector(z, a, r);
- var (Ca, S) = SerialNumberPublicPoints(z, a, r);
+ var (Ca, S) = ProofSystem.SerialNumberPublicPoints(z, a, r);
var statement = ProofSystem.SerialNumber(Ca, S);
var proofOfSerialNumber = ProofSystem.Prove(new Knowledge(statement, witness), rnd);
@@ -82,7 +79,7 @@ namespace WalletWasabi.Tests.UnitTests.Crypto
a = Scalar.Zero;
{
var witness = new ScalarVector(z, a, r);
- var (Ca, S) = SerialNumberPublicPoints(z, a, r);
+ var (Ca, S) = ProofSystem.SerialNumberPublicPoints(z, a, r);
var statement = ProofSystem.SerialNumber(Ca, S);
var proofOfSerialNumber = ProofSystem.Prove(new Knowledge(statement, witness), rnd);
@@ -107,18 +104,19 @@ namespace WalletWasabi.Tests.UnitTests.Crypto
var Ma = amount * Generators.Gg + r * Generators.Gh;
// The coordinator generates a MAC and a proof that the MAC was generated using the
- // coordinator's secret key. The coordinator sends the pair (MAC + proofOfMac) back
+ // coordinator's secret key. The coordinator sends the pair (MAC, proofOfMac) back
// to the client.
var t = rnd.GetScalar();
var mac = MAC.ComputeMAC(coordinatorKey, Ma, t);
- // The client randomizes the commitments before presenting the them to the coordinator
- // proves to the coordinator that a credential is valid
+ // The client randomizes the commitments before presenting them to the coordinator proving to
+ // the coordinator that a credential is valid (prover knows a valid MAC on non-randomized attribute)
var z = rnd.GetScalar();
- var (knowledge, randomizedCommitments) = ProofSystem.MacShow(coordinatorParameters, mac, z, amount, r);
+ var randomizedCommitments = RandomizedCommitments.RandomizeMAC(mac, z, Ma);
+ var knowledge = ProofSystem.MacShow(coordinatorParameters, randomizedCommitments, z, mac.T);
var proofOfMacShow = ProofSystem.Prove(knowledge, rnd);
- // The coordinator must verify the received "randomized" credential is valid.
+ // The coordinator must verify the received randomized credential is valid.
var Z = ProofSystem.ComputeZ(randomizedCommitments, coordinatorKey);
Assert.Equal(Z, z * coordinatorParameters.I);

MODIFY
WalletWasabi/Crypto/ZeroKnowledge/ProofSystem.cs
WalletWasabi/Crypto/ZeroKnowledge/ProofSystem.cs
using NBitcoin.Secp256k1;
+using System;
using System.Linq;
using WalletWasabi.Crypto.Groups;
using WalletWasabi.Crypto.Randomness;
@@ -53,16 +54,11 @@ namespace WalletWasabi.Crypto.ZeroKnowledge
{ S, O, O, Generators.Gs }
});
- public static (Knowledge knowledge, RandomizedCommitments randomizedCommitments) MacShow(CoordinatorParameters iparams, MAC mac, Scalar z, Scalar a, Scalar r)
- {
- var Ca = z * Generators.Ga + a * Generators.Gg + r * Generators.Gh;
- var Cx0 = z * Generators.Gx0 + mac.U;
- var Cx1 = z * Generators.Gx1 + mac.T * mac.U;
- var CV = z * Generators.GV + mac.V;
- var Z = z * iparams.I;
+ public static (GroupElement Ca, GroupElement S) SerialNumberPublicPoints(Scalar z, Scalar a, Scalar r)
+ => (z * Generators.Ga + r * Generators.Gh + a * Generators.Gg, r * Generators.Gs);
- return (new Knowledge(MacShow(iparams, Z, Cx0, Cx1), new ScalarVector(z, (mac.T * z).Negate(), mac.T)), new RandomizedCommitments(Ca, Cx0, Cx1, CV));
- }
+ public static Knowledge MacShow(CoordinatorParameters iparams, RandomizedCommitments c, Scalar z, Scalar t)
+ => new Knowledge(MacShow(iparams, z * iparams.I, c.Cx0, c.Cx1), new ScalarVector(z, (t * z).Negate(), t));
public static Statement MacShow(CoordinatorParameters iparams, GroupElement Z, GroupElement Cx0, GroupElement Cx1)
=> new Statement(new GroupElement[,]

MODIFY
WalletWasabi/Crypto/ZeroKnowledge/RandomizedCommitments.cs
WalletWasabi/Crypto/ZeroKnowledge/RandomizedCommitments.cs
+using NBitcoin.Secp256k1;
using WalletWasabi.Crypto.Groups;
namespace WalletWasabi.Crypto.ZeroKnowledge
{
public class RandomizedCommitments
{
- public RandomizedCommitments(GroupElement Ca, GroupElement Cx0, GroupElement Cx1, GroupElement CV)
+ public static RandomizedCommitments RandomizeMAC(MAC mac, Scalar z, GroupElement Ma)
+ {
+ GroupElement Randomize(GroupElement G, GroupElement M) => M + z * G;
+ return new RandomizedCommitments(
+ Ca: Randomize(Generators.Ga, Ma),
+ Cx0: Randomize(Generators.Gx0, mac.U),
+ Cx1: Randomize(Generators.Gx1, mac.T * mac.U),
+ CV: Randomize(Generators.GV, mac.V));
+ }
+
+ private RandomizedCommitments(GroupElement Ca, GroupElement Cx0, GroupElement Cx1, GroupElement CV)
{
this.Ca = Ca;
this.Cx0 = Cx0;

Refactoring randomization and suggestions CR