exponentiation-proof-handler.js 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311
  1. /*
  2. * Copyright 2018 Scytl Secure Electronic Voting SA
  3. *
  4. * All rights reserved
  5. *
  6. * See our extended copyright notice in *file 'Copyright.txt' which is part of this source code package
  7. */
  8. /* jshint node:true */
  9. 'use strict';
  10. var ZeroKnowledgeProofProver = require('../prover');
  11. var ZeroKnowledgeProofVerifier = require('../verifier');
  12. var ZeroKnowledgeProof = require('../proof');
  13. var ZeroKnowledgeProofPreComputation = require('../pre-computation');
  14. var PhiFunction = require('../phi-function');
  15. var ProgressMeter = require('../progress-meter');
  16. var validator = require('../input-validator');
  17. module.exports = ExponentiationProofHandler;
  18. /**
  19. * @class ExponentiationProofHandler
  20. * @classdesc Encapsulates a handler for the exponentiation zero-knowledge proof
  21. * of knowledge generation, pre-computation and verification
  22. * processes. To instantiate this object, use the method {@link
  23. * ZeroKnowledgeProofService.newExponentiationProofHandler}.
  24. * @param {ZpSubgroup}
  25. * group The Zp subgroup to which all exponents and Zp group elements
  26. * required for the proof generation are associated or belong,
  27. * respectively.
  28. * @param {MessageDigestService}
  29. * messageDigestService The message digest service.
  30. * @param {MathematicalService}
  31. * mathematicalService The mathematical service.
  32. */
  33. function ExponentiationProofHandler(
  34. group, messageDigestService, mathematicalService) {
  35. var NUM_PHI_INPUTS = 1;
  36. var DEFAULT_AUXILIARY_DATA = 'ExponentiationProof';
  37. var prover_ =
  38. new ZeroKnowledgeProofProver(messageDigestService, mathematicalService);
  39. var verifier_ =
  40. new ZeroKnowledgeProofVerifier(messageDigestService, mathematicalService);
  41. var progressCallback_;
  42. var progressPercentMinCheckInterval_;
  43. var measureProgress_ = false;
  44. var baseElements_;
  45. /**
  46. * Initializes the handler with the provided base elements.
  47. *
  48. * @function init
  49. * @memberof ExponentiationProofHandler
  50. * @param {ZpGroupElement[]}
  51. * baseElements The base elements.
  52. * @returns {ExponentiationProofHandler} A reference to this object, to
  53. * facilitate method chaining.
  54. * @throws {Error}
  55. * If the input data validation fails.
  56. */
  57. this.init = function(baseElements) {
  58. validator.checkZpGroupElements(
  59. baseElements,
  60. 'Base elements for exponentiation proof handler initialization', group);
  61. baseElements_ = baseElements;
  62. return this;
  63. };
  64. /**
  65. * Generates an exponentiation zero-knowledge proof of knowledge. Before
  66. * using this method, the handler must have been initialized with base
  67. * elements, via the method {@link ExponentiationProofHandler.init}.
  68. *
  69. * @function generate
  70. * @memberof ExponentiationProofHandler
  71. * @param {Exponent}
  72. * secret The secret exponent, the knowledge of which must be
  73. * proven.
  74. * @param {ZpGroupElement[]}
  75. * exponentiatedElements The base elements after exponentiation
  76. * with the secret exponent.
  77. * @param {Object}
  78. * [options] An object containing optional arguments.
  79. * @param {Uint8Array|string}
  80. * [options.data='ExponentiationProof'] Auxiliary data.
  81. * @param {ZeroKnowledgeProofPreComputation}
  82. * [options.preComputation=Generated internally] A
  83. * pre-computation of the exponentiation zero-knowledge proof of
  84. * knowledge.
  85. * @returns {ZeroKnowledgeProof} The exponentiation zero-knowledge proof of
  86. * knowledge.
  87. * @throws {Error}
  88. * If the input data validation fails.
  89. */
  90. this.generate = function(secret, exponentiatedElements, options) {
  91. if (typeof baseElements_ === 'undefined') {
  92. throw new Error(
  93. 'Cannot generate exponentiation proof; Associated handler has not been initialized with any base elements');
  94. }
  95. options = options || {};
  96. checkGenerationData(secret, exponentiatedElements, options);
  97. var data = options.data;
  98. if (typeof data === 'undefined') {
  99. data = DEFAULT_AUXILIARY_DATA;
  100. }
  101. var preComputation = options.preComputation;
  102. var privateValues = [secret];
  103. var publicValues = exponentiatedElements;
  104. if (typeof preComputation === 'undefined') {
  105. preComputation = this.preCompute();
  106. }
  107. return prover_.prove(
  108. group, privateValues, publicValues, data, preComputation);
  109. };
  110. /**
  111. * Pre-computes an exponentiation zero-knowledge proof of knowledge.
  112. * IMPORTANT: The same pre-computed values must not be used twice. Before
  113. * using this method, the handler must have been initialized with base
  114. * elements, via the method {@link ExponentiationProofHandler.init}.
  115. *
  116. * @function preCompute
  117. * @memberof ExponentiationProofHandler
  118. * @returns {ZeroKnowledgeProofPreComputation} The exponentiation
  119. * zero-knowledge proof of knowledge pre-computation.
  120. */
  121. this.preCompute = function() {
  122. if (typeof baseElements_ === 'undefined') {
  123. throw new Error(
  124. 'Cannot pre-compute exponentiation proof; Associated handler has not been initialized with any base elements');
  125. }
  126. var phiFunction = newPhiFunction(group, baseElements_);
  127. if (!measureProgress_) {
  128. return prover_.preCompute(group, phiFunction);
  129. } else {
  130. var preComputation = prover_.preCompute(
  131. group, phiFunction, newProgressMeter(baseElements_));
  132. measureProgress_ = false;
  133. return preComputation;
  134. }
  135. };
  136. /**
  137. * Verifies an exponentiation zero-knowledge proof of knowledge. Before
  138. * using this method, the handler must have been initialized with base
  139. * elements, via the method {@link ExponentiationProofHandler.init}.
  140. *
  141. * @function verify
  142. * @memberof ExponentiationProofHandler
  143. * @param {ZeroKnowledgeProof}
  144. * proof The exponentiation zero-knowledge proof of knowledge to
  145. * verify.
  146. * @param {ZpGroupElement[]}
  147. * exponentiatedElements The base elements after exponentiation
  148. * with the secret exponent.
  149. * @param {Object}
  150. * [options] An object containing optional arguments.
  151. * @param {Uint8Array|string}
  152. * [options.data='ExponentiationProof'] Auxiliary data. It must
  153. * be the same as that used to generate the proof.
  154. * @returns {boolean} <code>true</code> if the exponentiation
  155. * zero-knowledge proof of knowledge was verified,
  156. * <code>false</code> otherwise.
  157. * @throws {Error}
  158. * If the input data validation fails.
  159. */
  160. this.verify = function(proof, exponentiatedElements, options) {
  161. if (typeof baseElements_ === 'undefined') {
  162. throw new Error(
  163. 'Cannot verify exponentiation proof; Associated handler has not been initialized with any base elements');
  164. }
  165. options = options || {};
  166. checkVerificationData(proof, exponentiatedElements, options);
  167. var data = options.data;
  168. if (typeof data === 'undefined') {
  169. data = DEFAULT_AUXILIARY_DATA;
  170. }
  171. var phiFunction = newPhiFunction(group, baseElements_);
  172. var publicValues = exponentiatedElements;
  173. if (!measureProgress_) {
  174. return verifier_.verify(group, proof, phiFunction, publicValues, data);
  175. } else {
  176. var verified = verifier_.verify(
  177. group, proof, phiFunction, publicValues, data,
  178. newProgressMeter(baseElements_));
  179. measureProgress_ = false;
  180. return verified;
  181. }
  182. };
  183. /**
  184. * Indicates that a progress meter is to be used for the next exponentiation
  185. * zero-knowledge proof of knowledge operation to be performed.
  186. *
  187. * @function measureProgress
  188. * @memberof ExponentiationProofHandler
  189. * @param {function}
  190. * callback The callback function for the progress meter.
  191. * @param {Object}
  192. * [options] An object containing optional arguments.
  193. * @param {number}
  194. * [minCheckInterval=10] The minimum interval used to check
  195. * progress, as a percentage of the expected final progress
  196. * value.
  197. * @returns {ExponentiationProofHandler} A reference to this object, to
  198. * facilitate method chaining.
  199. * @throws {Error}
  200. * If the input data validation fails.
  201. */
  202. this.measureProgress = function(callback, minCheckInterval) {
  203. validator.checkProgressMeterData(
  204. callback, minCheckInterval, 'Exponentiation zero-knowledge proof');
  205. progressCallback_ = callback;
  206. progressPercentMinCheckInterval_ = minCheckInterval;
  207. measureProgress_ = true;
  208. return this;
  209. };
  210. function newPhiFunction(group, baseElements) {
  211. var numOutputs = baseElements.length;
  212. var computationRules = generateComputationRules(numOutputs);
  213. return new PhiFunction(
  214. NUM_PHI_INPUTS, numOutputs, computationRules, baseElements);
  215. }
  216. function generateComputationRules(numOutputs) {
  217. var rules = [];
  218. for (var i = 0; i < numOutputs; i++) {
  219. rules[i] = [];
  220. rules[i][0] = [];
  221. rules[i][0].push(i + 1);
  222. rules[i][0].push(1);
  223. }
  224. return rules;
  225. }
  226. function newProgressMeter(baseElements) {
  227. var progressMax = baseElements.length;
  228. return new ProgressMeter(
  229. progressMax, progressCallback_, progressPercentMinCheckInterval_);
  230. }
  231. function checkGenerationData(secret, exponentiatedElements, options) {
  232. validator.checkExponent(
  233. secret, 'Secret exponent for exponentiation proof generation', group.q);
  234. validator.checkZpGroupElements(
  235. exponentiatedElements,
  236. 'Exponentiated base elements for exponentiation proof generation',
  237. group);
  238. validator.checkArrayLengthsEqual(
  239. baseElements_, 'base elements for exponentiation proof generation',
  240. exponentiatedElements, 'exponentiated base elements');
  241. if (typeof options.data !== 'undefined' &&
  242. typeof options.data !== 'string') {
  243. validator.checkIsInstanceOf(
  244. options.data, Uint8Array, 'Uint8Array',
  245. 'Non-string auxiliary data for exponentiation proof generation');
  246. }
  247. if (options.preComputation) {
  248. validator.checkIsInstanceOf(
  249. options.preComputation, ZeroKnowledgeProofPreComputation,
  250. 'ZeroKnowledgeProofPreComputation',
  251. 'Pre-computation for exponentiation proof generation');
  252. }
  253. }
  254. function checkVerificationData(proof, exponentiatedElements, options) {
  255. validator.checkIsInstanceOf(
  256. proof, ZeroKnowledgeProof, 'ZeroKnowledgeProof',
  257. 'Exponentiation zero-knowledge proof');
  258. validator.checkZpGroupElements(
  259. exponentiatedElements,
  260. 'Exponentiated base elements for exponentiation proof verification',
  261. group);
  262. validator.checkArrayLengthsEqual(
  263. baseElements_, 'base elements for exponentiation proof verification',
  264. exponentiatedElements, 'exponentiated base elements');
  265. if (typeof options.data !== 'undefined' &&
  266. typeof options.data !== 'string') {
  267. validator.checkIsInstanceOf(
  268. options.data, Uint8Array, 'Uint8Array',
  269. 'Non-string auxiliary data for exponentiation proof verification');
  270. }
  271. }
  272. }