Module: RSA::ACC::PoKE2

Extended by:
Functions
Includes:
Functions
Defined in:
lib/rsa/acc/poke2.rb

Overview

Non-Interactive Proof of knowledge of exponent2.

Constant Summary

Constants included from Functions

Functions::CHALLENGE_DST, Functions::ELEMENT_DST, Functions::HASH_DST

Class Method Summary collapse

Methods included from Functions

blake2_hash, compute_challenge, egcd, elements_to_prime, hash_to_prime, normalize, shamir_trick, valid_elements?

Class Method Details

.prove(base, exp, result, modulus) ⇒ RSA::ACC::PoKE2Proof

Computes a proof that you know exp s.t. base ^ exp = result.

Parameters:

  • base (Integer)
  • exp (Integer)
  • result (Integer)
  • modulus (Integer)

Returns:



44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/rsa/acc/poke2.rb', line 44

def prove(base, exp, result, modulus)
  g = RSA::Accumulator::RSA2048_UNKNOWN_ELEM
  base = normalize(base, modulus)
  result = normalize(result, modulus)
  z = normalize(g.pow(exp, modulus), modulus)
  l = compute_challenge(base, result, z)
  alpha = blake2_hash(base, result, z, l)
  q, r = exp.divmod(l)
  u = (base * g.pow(alpha, modulus)) % modulus
  RSA::ACC::PoKE2Proof.new(z, normalize(u.pow(q, modulus), modulus), r)
end

.verify(base, result, proof, modulus) ⇒ Boolean

Verifies that the prover knows exp s.t. base ^ exp = result

Parameters:

Returns:

  • (Boolean) —

    Returns true for successful verification, false otherwise.



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/rsa/acc/poke2.rb', line 62

def verify(base, result, proof, modulus)
  # A proof comes from an untrusted prover, so a malformed one is a false result and
  # not an exception.
  return false unless proof.is_a?(RSA::ACC::PoKE2Proof)
  return false unless [base, result, modulus, proof.z, proof.q, proof.r].all? { |v| v.is_a?(Integer) }
  return false unless modulus > 1 && !proof.r.negative?
  g = RSA::Accumulator::RSA2048_UNKNOWN_ELEM
  base = normalize(base, modulus)
  result = normalize(result, modulus)
  z = normalize(proof.z, modulus)
  q = normalize(proof.q, modulus)
  l = compute_challenge(base, result, z)
  alpha = blake2_hash(base, result, z, l)
  u = (base * g.pow(alpha, modulus)) % modulus
  lhs = normalize(q.pow(l, modulus) * u.pow(proof.r, modulus), modulus)
  rhs = normalize(result * z.pow(alpha, modulus), modulus)
  lhs == rhs
end