Longfellow ZK 0290cb32

Loading...
Searching...
No Matches
small_witness.h
1// Copyright 2025 Google LLC.
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#ifndef PRIVACY_PROOFS_ZK_LIB_CIRCUITS_ANONCRED_SMALL_WITNESS_H_
16#define PRIVACY_PROOFS_ZK_LIB_CIRCUITS_ANONCRED_SMALL_WITNESS_H_
17
18#include <stddef.h>
19#include <string.h>
20
21#include <cstdint>
22#include <vector>
23
24#include "algebra/static_string.h"
25#include "arrays/dense.h"
26#include "circuits/anoncred/small_io.h"
27#include "circuits/ecdsa/verify_witness.h"
28#include "circuits/logic/bit_plucker_encoder.h"
29#include "circuits/mdoc/mdoc_witness.h"
30#include "circuits/sha/flatsha256_witness.h"
31
32 namespace proofs {
33
34 class SmallOpenedAttribute {
35 public:
36 size_t ind_, len_;
37 std::vector<uint8_t> value_;
38 SmallOpenedAttribute(size_t ind, size_t len, const uint8_t* val, size_t vlen)
39 : ind_(ind), len_(len), value_(val, val + vlen) {}
40};
41
42 template <typename EC, typename Field, class ScalarField>
43 class SmallWitness {
44 using ECField = typename EC::Field;
45 using ECElt = typename ECField::Elt;
46 using ECNat = typename ECField::N;
47 using Elt = typename Field::Elt;
48 using Nat = typename Field::N;
49 using EcdsaWitness = VerifyWitness3<EC, ScalarField>;
50 static constexpr size_t kMaxSHABlocks = 7;
51
52 public:
53 const EC ec_;
54 Elt e_, e2_; /* Issuer signature values. */
55 Elt dpkx_, dpky_; /* device key */
56 EcdsaWitness ew_, dkw_;
57 uint8_t now_[kDateLen]; /* CBOR-formatted time used for expiry comparison. */
58
59 FlatSHA256Witness::BlockWitness bw_[kMaxSHABlocks];
60 uint8_t signed_bytes_[kMaxSHABlocks * 64];
61 uint8_t numb_; /* Number of the correct sha block. */
62
63 explicit SmallWitness(const EC& ec, const ScalarField& Fn)
64 : ec_(ec), ew_(Fn, ec), dkw_(Fn, ec) {}
65
66 void fill_sha(DenseFiller<Field>& filler,
67 const FlatSHA256Witness::BlockWitness& bw) const {
68 BitPluckerEncoder<Field, 3> BPENC(ec_.f_);
69 for (size_t k = 0; k < 48; ++k) {
70 filler.push_back(BPENC.mkpacked_v32(bw.outw[k]));
71 }
72 for (size_t k = 0; k < 64; ++k) {
73 filler.push_back(BPENC.mkpacked_v32(bw.oute[k]));
74 filler.push_back(BPENC.mkpacked_v32(bw.outa[k]));
75 }
76 for (size_t k = 0; k < 8; ++k) {
77 filler.push_back(BPENC.mkpacked_v32(bw.h1[k]));
78 }
79 }
80
81 void fill_witness(DenseFiller<Field>& filler, bool small = false) const {
82 filler.push_back(e_);
83 filler.push_back(dpkx_);
84 filler.push_back(dpky_);
85
86 ew_.fill_witness(filler);
87 dkw_.fill_witness(filler);
88
89 filler.push_back(numb_, 8, ec_.f_);
90 for (size_t i = 0; i < kMaxSHABlocks * 64; ++i) {
91 filler.push_back(signed_bytes_[i], 8, ec_.f_);
92 }
93 for (size_t j = 0; j < kMaxSHABlocks; j++) {
94 fill_sha(filler, bw_[j]);
95 }
96 }
97
98 bool compute_witness(Elt pkX, Elt pkY, const uint8_t mdoc[/* len */],
99 size_t len, const uint8_t transcript[/* tlen */],
100 size_t tlen, const uint8_t tnow[/*kDateLen*/],
101 const StaticString& r, const StaticString& s,
102 const StaticString& dr, const StaticString& ds) {
103 Nat ne = nat_from_hash<Nat>(mdoc, len);
104 e_ = ec_.f_.to_montgomery(ne);
105
106 // Parse (r,s).
107 Nat nr = Nat(r);
108 Nat ns = Nat(s);
109 ew_.compute_witness(pkX, pkY, ne, nr, ns);
110
111 Nat ne2 = nat_from_hash<Nat>(transcript, tlen);
112 Nat nr2 = Nat(dr);
113 Nat ns2 = Nat(ds);
114
115 dpkx_ = ec_.f_.to_montgomery(nat_from_be<Nat>(&mdoc[100]));
116 dpky_ = ec_.f_.to_montgomery(nat_from_be<Nat>(&mdoc[132]));
117 e2_ = ec_.f_.to_montgomery(ne2);
118 dkw_.compute_witness(dpkx_, dpky_, ne2, nr2, ns2);
119
120 FlatSHA256Witness::transform_and_witness_message(len, mdoc, kMaxSHABlocks,
121 numb_, signed_bytes_, bw_);
122
123 memcpy(now_, tnow, kDateLen);
124 return true;
125 }
126};
127
128} // namespace proofs
129
130#endif // PRIVACY_PROOFS_ZK_LIB_CIRCUITS_ANONCRED_SMALL_WITNESS_H_
proofs::BitPluckerEncoder
Definition bit_plucker_encoder.h:27
proofs::DenseFiller
Definition dense.h:153
proofs::VerifyWitness3
Definition verify_witness.h:30
StaticString
Definition static_string.h:22
proofs::FlatSHA256Witness::BlockWitness
Definition flatsha256_witness.h:27
proofs::GF2_128::Elt
Definition gf2_128.h:63