pub fn verify_ciphertext_integrity(
    crsz: &Crsz,
    tau: &[Bit],
    associated_data: &[u8],
    sys: &SysParam,
) -> Result<(), ()> {
    let n = if crsz.cc.is_empty() {
        0
    } else {
        crsz.cc[0].len()
    };
    if crsz.rr.len() != n || crsz.ss.len() != n || crsz.zz.len() != n {
        // In theory, this is unreachable fail because deserialization only succeeds
        // when the vectors of a CRSZ have the same length. (In practice, it's
        // surprising how often "unreachable" code is reached!)
        return Err(());
    }

    use miracl_core::bls12381::pair;
    let mut g1_neg = ECP::generator();
    g1_neg.neg();
    let extended_tau = extend_tau(&crsz.cc, &crsz.rr, &crsz.ss, tau, associated_data);
    let mut id = ftau(&extended_tau, sys).expect("extended_tau not the correct size");

    // Pre-compute the line calculations (for pairing) on `id`
    // (the multi-pairing requires that `id` be in affine coordinates;
    // the `another` function projects to affine coords, but `another_pc` doesn't).
    id.affine();
    let mut precomp_id = [FP4::new(); G2_TABLE];
    pair::precomp(&mut precomp_id, &id);

    // check for all j:
    //     1 =
    //      e(g1^{-1}, Z_j) *
    //      e(R_j, f_0 \Prod_{i=0}^{\lambda} f_i^{\tau_i}) *
    //      e(S_j,h)
    //   (PRECOMP_SYS_H is the system-parameter h value,
    //   pre-loaded before this function call)
    //
    //   Cf. the `bls.rs` example in the `miracl_core` repo.
    let checks: Result<(), ()> = crsz
        .rr
        .iter()
        .zip(crsz.ss.iter().zip(crsz.zz.iter()))
        .try_for_each(|(spec_r, (s, z))| {
            // Initialize (to 1) an array of Fp12 points
            // (one for each iteration of the Miller loop).
            let mut r = pair::initmp();

            // Compute all the necessary line functions and evaluations,
            // for the three pairing computations.
            pair::another_pc(&mut r, &precomp_id, spec_r);
            pair::another_pc(&mut r, &PRECOMP_SYS_H[..], s);
            pair::another(&mut r, z, &g1_neg);

            // Collapse the Fp12 array built above,
            // by making the appropriate multiplications of the Miller loop.
            let mut v = pair::miller(&mut r);

            // Perform final exponentiation.
            v = pair::fexp(&v);

            if v.isunity() {
                Ok(())
            } else {
                Err(())
            }
        });
    checks
}
/// Verify ciphertext integrity
///
/// Part of DVfy of Section 7.1 of <https://eprint.iacr.org/2021/339.pdf>
//
/// In addition to verifying the proofs of chunking and sharing,
/// we must also verify ciphertext integrity.
Verify ciphertext integrity
Part of DVfy of Section 7.1 of

In addition to verifying the proofs of chunking and sharing,
we must also verify ciphertext integrity.
Verify ciphertext integrity Part of DVfy of Section 7 . 1 of In addition to verifying the proofs of chunking and sharing we must also verify ciphertext integrity .
pub fn verify_ciphertext_integrity(
    crsz: &Crsz,
    tau: &[Bit],
    associated_data: &[u8],
    sys: &SysParam,
) -> Result<(), ()> {
    let n = if crsz.cc.is_empty() {
        0
    } else {
        crsz.cc[0].len()
    };
    if crsz.rr.len() != n || crsz.ss.len() != n || crsz.zz.len() != n {
        // In theory, this is unreachable fail because deserialization only succeeds
        // when the vectors of a CRSZ have the same length. (In practice, it's
        // surprising how often "unreachable" code is reached!)
        return Err(());
    }
    use miracl_core::bls12381::pair;
    let mut g1_neg = ECP::generator();
    g1_neg.neg();
    let extended_tau = extend_tau(&crsz.cc, &crsz.rr, &crsz.ss, tau, associated_data);
    let mut id = ftau(&extended_tau, sys).expect("extended_tau not the correct size");
    // Pre-compute the line calculations (for pairing) on `id`
    // (the multi-pairing requires that `id` be in affine coordinates;
    // the `another` function projects to affine coords, but `another_pc` doesn't).
    id.affine();
    let mut precomp_id = [FP4::new(); G2_TABLE];
    pair::precomp(&mut precomp_id, &id);
    // check for all j:
    //     1 =
    //      e(g1^{-1}, Z_j) *
    //      e(R_j, f_0 \Prod_{i=0}^{\lambda} f_i^{\tau_i}) *
    //      e(S_j,h)
    //   (PRECOMP_SYS_H is the system-parameter h value,
    //   pre-loaded before this function call)
    //
    //   Cf. the `bls.rs` example in the `miracl_core` repo.
    let checks: Result<(), ()> = crsz
        .rr
        .iter()
        .zip(crsz.ss.iter().zip(crsz.zz.iter()))
        .try_for_each(|(spec_r, (s, z))| {
            // Initialize (to 1) an array of Fp12 points
            // (one for each iteration of the Miller loop).
            let mut r = pair::initmp();
            // Compute all the necessary line functions and evaluations,
            // for the three pairing computations.
            pair::another_pc(&mut r, &precomp_id, spec_r);
            pair::another_pc(&mut r, &PRECOMP_SYS_H[..], s);
            pair::another(&mut r, z, &g1_neg);
            // Collapse the Fp12 array built above,
            // by making the appropriate multiplications of the Miller loop.
            let mut v = pair::miller(&mut r);
            // Perform final exponentiation.
            v = pair::fexp(&v);
            if v.isunity() {
                Ok(())
            } else {
                Err(())
            }
        });
    checks
}
pub fn verify_ciphertext_integrity ( crsz : & Crsz , tau : & [ Bit ] , associated_data : & [ u8 ] , sys : & SysParam , ) -> Result < ( ) , ( ) > { let n = if crsz . cc . is_empty ( ) { 0 } else { crsz . cc [ 0 ] . len ( ) } ; if crsz . rr . len ( ) != n || crsz . ss . len ( ) != n || crsz . zz . len ( ) != n { // In theory, this is unreachable fail because deserialization only succeeds // when the vectors of a CRSZ have the same length. (In practice, it's // surprising how often "unreachable" code is reached!) return Err ( ( ) ) ; } use miracl_core :: bls12381 :: pair ; let mut g1_neg = ECP :: generator ( ) ; g1_neg . neg ( ) ; let extended_tau = extend_tau ( & crsz . cc , & crsz . rr , & crsz . ss , tau , associated_data ) ; let mut id = ftau ( & extended_tau , sys ) . expect ( " " ) ; // Pre-compute the line calculations (for pairing) on `id` // (the multi-pairing requires that `id` be in affine coordinates; // the `another` function projects to affine coords, but `another_pc` doesn't). id . affine ( ) ; let mut precomp_id = [ FP4 :: new ( ) ; G2_TABLE ] ; pair :: precomp ( & mut precomp_id , & id ) ; // check for all j: //     1 = //      e(g1^{-1}, Z_j) * //      e(R_j, f_0 \Prod_{i=0}^{\lambda} f_i^{\tau_i}) * //      e(S_j,h) //   (PRECOMP_SYS_H is the system-parameter h value, //   pre-loaded before this function call) // //   Cf. the `bls.rs` example in the `miracl_core` repo. let checks : Result < ( ) , ( ) > = crsz . rr . iter ( ) . zip ( crsz . ss . iter ( ) . zip ( crsz . zz . iter ( ) ) ) . try_for_each ( | ( spec_r , ( s , z ) ) | { // Initialize (to 1) an array of Fp12 points // (one for each iteration of the Miller loop). let mut r = pair :: initmp ( ) ; // Compute all the necessary line functions and evaluations, // for the three pairing computations. pair :: another_pc ( & mut r , & precomp_id , spec_r ) ; pair :: another_pc ( & mut r , & PRECOMP_SYS_H [ .. ] , s ) ; pair :: another ( & mut r , z , & g1_neg ) ; // Collapse the Fp12 array built above, // by making the appropriate multiplications of the Miller loop. let mut v = pair :: miller ( & mut r ) ; // Perform final exponentiation. v = pair :: fexp ( & v ) ; if v . isunity ( ) { Ok ( ( ) ) } else { Err ( ( ) ) } } ) ; checks }
Verify ciphertext integrity
Part of DVfy of Section 7.1 of <https://eprint.iacr.org/2021/339.pdf>
Verify ciphertext integrity Part of DVfy of Section 7 . 1 of <https : // eprint . iacr . org / 2021 / 339 . pdf >
crsz
&Crsz
tau
&[Bit]
associated_data
&[u8]
sys
&SysParam
crsz
&Crsz
tau
&[Bit]
associated_data
&[u8]
sys
&SysParam