Add serial number proof
Remove FQ LinearRelation and NonInteractive in ProofSystem
MODIFY
WalletWasabi.Tests/UnitTests/Crypto/ProofSystemTests.cs
WalletWasabi.Tests/UnitTests/Crypto/ProofSystemTests.cs
using System;
+using System.Linq;
using NBitcoin.Secp256k1;
using WalletWasabi.Crypto;
using WalletWasabi.Crypto.Groups;
using WalletWasabi.Crypto.Randomness;
using WalletWasabi.Crypto.ZeroKnowledge;
+using WalletWasabi.Crypto.ZeroKnowledge.LinearRelation;
+using WalletWasabi.Crypto.ZeroKnowledge.NonInteractive;
using Xunit;
namespace WalletWasabi.Tests.UnitTests.Crypto
@@ -41,6 +44,41 @@ namespace WalletWasabi.Tests.UnitTests.Crypto
var clientStatement = ProofSystem.IssuerParameters(coordinatorParameters, mac, Ma);
var isValidProof = ProofSystem.Verify(clientStatement, proofOfMac);
+ Assert.True(isValidProof);
+ ////////
+
+ var corruptedResponses = new ScalarVector(proofOfMac.Responses.Reverse());
+ var invalidProofOfMac = new Proof(proofOfMac.PublicNonces, corruptedResponses);
+ isValidProof = ProofSystem.Verify(clientStatement, invalidProofOfMac);
+
+ Assert.False(isValidProof);
+
+ var corruptedPublicNonces = new GroupElementVector(proofOfMac.PublicNonces.Reverse());
+ invalidProofOfMac = new Proof(corruptedPublicNonces, proofOfMac.Responses);
+ isValidProof = ProofSystem.Verify(clientStatement, invalidProofOfMac);
+
+ Assert.False(isValidProof);
+ }
+
+ [Fact]
+ [Trait("UnitTest", "UnitTest")]
+ public void CanProveAndVerifySerialNumbers()
+ {
+ var rnd = new SecureRandom();
+ var z = rnd.GetScalar();
+ var r = rnd.GetScalar();
+ var a = rnd.GetScalar();
+
+ var witness = new ScalarVector(z, a, r);
+ var Ca = z * Generators.Ga + r * Generators.Gh + a * Generators.Gg;
+ var S = r * Generators.Gs;
+
+ var statement = ProofSystem.SerialNumber(Ca, S);
+ var proofOfSerialNumber = ProofSystem.Prove(new Knowledge(statement, witness), rnd);
+
+ // The coordinator must verify the blinded amout is zero
+ var isValidProof = ProofSystem.Verify(statement, proofOfSerialNumber);
+
Assert.True(isValidProof);
}
}

MODIFY
WalletWasabi/Crypto/ZeroKnowledge/ProofSystem.cs
WalletWasabi/Crypto/ZeroKnowledge/ProofSystem.cs
@@ -11,7 +11,7 @@ namespace WalletWasabi.Crypto.ZeroKnowledge
{
private static GroupElement O = GroupElement.Infinity;
- public static bool Verify(LinearRelation.Statement statement, Proof proof)
+ public static bool Verify(Statement statement, Proof proof)
{
return Verifier.Verify(new Transcript(new byte[0]), new[] { statement }, new[] { proof });
}
@@ -40,5 +40,17 @@ namespace WalletWasabi.Crypto.ZeroKnowledge
{ Generators.GV - iparams.I, O, O, Generators.Gx0, Generators.Gx1, Generators.Ga },
{ iparams.Cw, Generators.Gw, Generators.Gwp, O, O, O },
});
+
+ public static Knowledge SerialNumber(GroupElement Ca, GroupElement S, Scalar z, Scalar a, Scalar r)
+ => new Knowledge(SerialNumber(Ca, S), new ScalarVector(z, a, r));
+
+ public static Statement SerialNumber(GroupElement Ca, GroupElement S)
+ => new Statement(new GroupElement[,]
+ {
+ // public Witness terms:
+ // point z a r
+ { Ca, Generators.Ga, Generators.Gg, Generators.Gh },
+ { S, O, O, Generators.Gs }
+ });
}
}

Add serial number proof

Remove FQ LinearRelation and NonInteractive in ProofSystem