cardano-crypto-praos/cbits/vrf10_batchcompat/verify.c
static int
vrf_verify_batchcompat(const ge25519_p3 *Y_point, const unsigned char pi[crypto_vrf_ietfdraft10_PROOFBYTES_BATCHCOMPAT],
           const unsigned char *alpha, const unsigned long long alphalen)
{
    /* Note: c fits in 16 bytes, but ge25519_scalarmult expects a 32-byte scalar.*/
    unsigned char h_string[crypto_core_ed25519_BYTES], cn_scalar[crypto_core_ed25519_SCALARBYTES], c_scalar[crypto_core_ed25519_SCALARBYTES], s_scalar[crypto_core_ed25519_SCALARBYTES],
            U_bytes[crypto_core_ed25519_BYTES], V_bytes[crypto_core_ed25519_BYTES], expected_U_bytes[crypto_core_ed25519_BYTES], expected_V_bytes[crypto_core_ed25519_BYTES];

    ge25519_p2     U_point, V_point;
    ge25519_p3     H_point, Gamma_point, tmp_p3_point;
    ge25519_p1p1   tmp_p1p1_point;
    ge25519_cached tmp_cached_point;

    if (_vrf_ietfdraft10_decode_proof_batchcompat(&Gamma_point, expected_U_bytes, expected_V_bytes, s_scalar, pi) != 0) {
        return -1;
    }

#ifdef TRYANDINC
    /*
     * If try and increment fails after `TAI_NR_TRIES` tries, then we run elligator, to ensure that
     * the function runs correctly.
     */
    if (_vrf_ietfdraft10_hash_to_curve_try_inc(h_string, Y_point, alpha, alphalen) != 0) {
        _vrf_ietfdraft03_hash_to_curve_elligator2_25519(h_string, Y_point, alpha, alphalen);
    };
#else
    _vrf_ietfdraft10_hash_to_curve_elligator2_25519(h_string, Y_point, alpha, alphalen);
#endif
    ge25519_frombytes(&H_point, h_string);

    _vrf_ietfdraft10_hash_points(c_scalar, &H_point, &Gamma_point, expected_U_bytes, expected_V_bytes);
    /* vrf_decode_proof writes to the first 16 bytes of c_scalar; we zero the
     * second 16 bytes ourselves, as ge25519_scalarmult expects a 32-byte scalar.
     */
    memset(c_scalar+16, 0, 16);
    crypto_core_ed25519_scalar_negate(cn_scalar, c_scalar); /* negate scalar c */

    /* calculate U = s*B - c*Y */
    ge25519_double_scalarmult_vartime(&U_point, cn_scalar, Y_point, s_scalar);

    /* calculate V = s*H -  c*Gamma */
    ge25519_double_scalarmult_vartime_variable(&V_point, cn_scalar, &Gamma_point, s_scalar, &H_point);

    ge25519_tobytes(U_bytes, &U_point);
    ge25519_tobytes(V_bytes, &V_point);

    for (int i = 0; i<crypto_core_ed25519_BYTES; i++) {
        if (U_bytes[i] != expected_U_bytes[i] || V_bytes[i] != expected_V_bytes[i]) {
            return -1;
        }
    }
    return 0;
}
/* Verify a proof for batch compatible proofs. Return 0 on success, -1 on failure.
 * We assume Y_point has passed public key validation already.
 * Assuming verification succeeds, runtime does not depend on the message alpha
 * (but does depend on its length alphalen)
 */
Verify a proof for batch compatible proofs. Return 0 on success, -1 on failure.
We assume Y_point has passed public key validation already.
Assuming verification succeeds, runtime does not depend on the message alpha
(but does depend on its length alphalen)
Verify a proof for batch compatible proofs . Return 0 on success - 1 on failure . We assume Y_point has passed public key validation already . Assuming verification succeeds runtime does not depend on the message alpha ( but does depend on its length alphalen )
static int
vrf_verify_batchcompat(const ge25519_p3 *Y_point, const unsigned char pi[crypto_vrf_ietfdraft10_PROOFBYTES_BATCHCOMPAT],
           const unsigned char *alpha, const unsigned long long alphalen)
{
    unsigned char h_string[crypto_core_ed25519_BYTES], cn_scalar[crypto_core_ed25519_SCALARBYTES], c_scalar[crypto_core_ed25519_SCALARBYTES], s_scalar[crypto_core_ed25519_SCALARBYTES],
            U_bytes[crypto_core_ed25519_BYTES], V_bytes[crypto_core_ed25519_BYTES], expected_U_bytes[crypto_core_ed25519_BYTES], expected_V_bytes[crypto_core_ed25519_BYTES];
    ge25519_p2     U_point, V_point;
    ge25519_p3     H_point, Gamma_point, tmp_p3_point;
    ge25519_p1p1   tmp_p1p1_point;
    ge25519_cached tmp_cached_point;
    if (_vrf_ietfdraft10_decode_proof_batchcompat(&Gamma_point, expected_U_bytes, expected_V_bytes, s_scalar, pi) != 0) {
        return -1;
    }
#ifdef TRYANDINC
    if (_vrf_ietfdraft10_hash_to_curve_try_inc(h_string, Y_point, alpha, alphalen) != 0) {
        _vrf_ietfdraft03_hash_to_curve_elligator2_25519(h_string, Y_point, alpha, alphalen);
    };
#else
    _vrf_ietfdraft10_hash_to_curve_elligator2_25519(h_string, Y_point, alpha, alphalen);
#endif
    ge25519_frombytes(&H_point, h_string);
    _vrf_ietfdraft10_hash_points(c_scalar, &H_point, &Gamma_point, expected_U_bytes, expected_V_bytes);
    memset(c_scalar+16, 0, 16);
    crypto_core_ed25519_scalar_negate(cn_scalar, c_scalar); 
    ge25519_double_scalarmult_vartime(&U_point, cn_scalar, Y_point, s_scalar);
    ge25519_double_scalarmult_vartime_variable(&V_point, cn_scalar, &Gamma_point, s_scalar, &H_point);
    ge25519_tobytes(U_bytes, &U_point);
    ge25519_tobytes(V_bytes, &V_point);
    for (int i = 0; i<crypto_core_ed25519_BYTES; i++) {
        if (U_bytes[i] != expected_U_bytes[i] || V_bytes[i] != expected_V_bytes[i]) {
            return -1;
        }
    }
    return 0;
}
static int vrf_verify_batchcompat ( const ge25519_p3 * Y_point , const unsigned char pi [ crypto_vrf_ietfdraft10_PROOFBYTES_BATCHCOMPAT ] , const unsigned char * alpha , const unsigned long long alphalen ) { unsigned char h_string [ crypto_core_ed25519_BYTES ] , cn_scalar [ crypto_core_ed25519_SCALARBYTES ] , c_scalar [ crypto_core_ed25519_SCALARBYTES ] , s_scalar [ crypto_core_ed25519_SCALARBYTES ] , U_bytes [ crypto_core_ed25519_BYTES ] , V_bytes [ crypto_core_ed25519_BYTES ] , expected_U_bytes [ crypto_core_ed25519_BYTES ] , expected_V_bytes [ crypto_core_ed25519_BYTES ] ; ge25519_p2 U_point , V_point ; ge25519_p3 H_point , Gamma_point , tmp_p3_point ; ge25519_p1p1 tmp_p1p1_point ; ge25519_cached tmp_cached_point ; if ( _vrf_ietfdraft10_decode_proof_batchcompat ( & Gamma_point , expected_U_bytes , expected_V_bytes , s_scalar , pi ) != 0 ) { return -1 ; } #ifdef TRYANDINC if ( _vrf_ietfdraft10_hash_to_curve_try_inc ( h_string , Y_point , alpha , alphalen ) != 0 ) { _vrf_ietfdraft03_hash_to_curve_elligator2_25519 ( h_string , Y_point , alpha , alphalen ) ; } ; #else _vrf_ietfdraft10_hash_to_curve_elligator2_25519 ( h_string , Y_point , alpha , alphalen ) ; #endif ge25519_frombytes ( & H_point , h_string ) ; _vrf_ietfdraft10_hash_points ( c_scalar , & H_point , & Gamma_point , expected_U_bytes , expected_V_bytes ) ; memset ( c_scalar + 16 , 0 , 16 ) ; crypto_core_ed25519_scalar_negate ( cn_scalar , c_scalar ) ; ge25519_double_scalarmult_vartime ( & U_point , cn_scalar , Y_point , s_scalar ) ; ge25519_double_scalarmult_vartime_variable ( & V_point , cn_scalar , & Gamma_point , s_scalar , & H_point ) ; ge25519_tobytes ( U_bytes , & U_point ) ; ge25519_tobytes ( V_bytes , & V_point ) ; for ( int i = 0 ; i < crypto_core_ed25519_BYTES ; i ++ ) { if ( U_bytes [ i ] != expected_U_bytes [ i ] || V_bytes [ i ] != expected_V_bytes [ i ] ) { return -1 ; } } return 0 ; }
Verify a proof for batch compatible proofs.
Verify a proof for batch compatible proofs .
/* Note: c fits in 16 bytes, but ge25519_scalarmult expects a 32-byte scalar.*/ /*
     * If try and increment fails after `TAI_NR_TRIES` tries, then we run elligator, to ensure that
     * the function runs correctly.
     */ /* vrf_decode_proof writes to the first 16 bytes of c_scalar; we zero the
     * second 16 bytes ourselves, as ge25519_scalarmult expects a 32-byte scalar.
     */ /* negate scalar c */ /* calculate U = s*B - c*Y */ /* calculate V = s*H -  c*Gamma */