schnorr-proof-handler.js 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291
  1. /*
  2. * Copyright 2018 Scytl Secure Electronic Voting SA
  3. *
  4. * All rights reserved
  5. *
  6. * See our extended copyright notice in *file 'Copyright.txt' which is part of this source code package
  7. */
  8. /* jshint node:true */
  9. 'use strict';
  10. var ZeroKnowledgeProofProver = require('../prover');
  11. var ZeroKnowledgeProofVerifier = require('../verifier');
  12. var ZeroKnowledgeProof = require('../proof');
  13. var ZeroKnowledgeProofPreComputation = require('../pre-computation');
  14. var PhiFunction = require('../phi-function');
  15. var ProgressMeter = require('../progress-meter');
  16. var validator = require('../input-validator');
  17. module.exports = SchnorrProofHandler;
  18. /**
  19. * @class SchnorrProofHandler
  20. * @classdesc Encapsulates a handler for the Schnorr zero-knowledge proof of
  21. * knowledge generation, pre-computation and verification processes.
  22. * To instantiate this object, use the method {@link
  23. * ZeroKnowledgeProofService.newSchnorrProofHandler}.
  24. * @param {ZpSubgroup}
  25. * group The Zp subgroup to which all exponents and Zp group elements
  26. * required for the proof generation are associated or belong,
  27. * respectively.
  28. * @param {MessageDigestService}
  29. * messageDigestService The message digest service.
  30. * @param {MathematicalService}
  31. * mathematicalService The mathematical service.
  32. */
  33. function SchnorrProofHandler(group, messageDigestService, mathematicalService) {
  34. var NUM_PHI_INPUTS = 1;
  35. var NUM_PHI_OUTPUTS = 1;
  36. var COMPUTATION_RULES = [[[1, 1]]];
  37. var DEFAULT_AUXILIARY_DATA = 'SchnorrProof';
  38. var VOTER_ID_PREFIX = 'SchnorrProof:VoterID=';
  39. var ELECTION_ID_PREFIX = 'ElectionEventID=';
  40. var prover_ =
  41. new ZeroKnowledgeProofProver(messageDigestService, mathematicalService);
  42. var verifier_ =
  43. new ZeroKnowledgeProofVerifier(messageDigestService, mathematicalService);
  44. var progressCallback_;
  45. var progressPercentMinCheckInterval_;
  46. var measureProgress_ = false;
  47. /**
  48. * Generates a Schnorr zero-knowledge proof of knowledge.
  49. *
  50. * @function generate
  51. * @memberof SchnorrProofHandler
  52. * @param {Exponent}
  53. * secret The secret exponent used to generate the gamma element,
  54. * the knowledge of which must be proven
  55. * @param {ZpGroupElement}
  56. * gamma The Zp subgroup generator exponentiated to the secret
  57. * exponent.
  58. * @param {Object}
  59. * [options] An object containing optional arguments.
  60. * @param {Uint8Array|string}
  61. * [options.data=''] Auxiliary data.
  62. * @param {ZeroKnowledgeProofPreComputation}
  63. * [options.preComputation=Generated internally] A
  64. * pre-computation of the Schnorr zero-knowledge proof of
  65. * knowledge.
  66. * @param {string}
  67. * [options.voterId] The voter ID. If this value is set then the
  68. * <code>electionId</code> option must also be set. In this
  69. * case, the <code>data</code> parameter will be ignored.
  70. * @param {string}
  71. * [options.electionId] The election ID. If this value is set
  72. * then the <code>voterId</code> option must also be set. In
  73. * this case, the <code>data</code> parameter will be ignored.
  74. * @returns {ZeroKnowledgeProof} The Schnorr zero-knowledge proof of
  75. * knowledge.
  76. * @throws {Error}
  77. * If the input data validation fails.
  78. */
  79. this.generate = function(secret, gamma, options) {
  80. options = options || {};
  81. checkGenerationData(secret, gamma, options);
  82. var data = options.data;
  83. if (typeof data === 'undefined') {
  84. data = DEFAULT_AUXILIARY_DATA;
  85. }
  86. var voterId = options.voterId;
  87. var electionId = options.electionId;
  88. if (voterId && electionId) {
  89. data = VOTER_ID_PREFIX + voterId + ELECTION_ID_PREFIX + electionId;
  90. }
  91. var preComputation = options.preComputation;
  92. var privateValues = [secret];
  93. var publicValues = [gamma];
  94. if (typeof preComputation === 'undefined') {
  95. preComputation = this.preCompute();
  96. }
  97. return prover_.prove(
  98. group, privateValues, publicValues, data, preComputation);
  99. };
  100. /**
  101. * Pre-computes a Schnorr zero-knowledge proof of knowledge. IMPORTANT: The
  102. * same pre-computed values must not be used twice.
  103. *
  104. * @function preCompute
  105. * @memberof SchnorrProofHandler
  106. * @returns {ZeroKnowledgeProofPreComputation} The Schnorr zero-knowledge
  107. * proof of knowledge pre-computation.
  108. */
  109. this.preCompute = function() {
  110. var phiFunction = newPhiFunction(group);
  111. if (!measureProgress_) {
  112. return prover_.preCompute(group, phiFunction);
  113. } else {
  114. var preComputation =
  115. prover_.preCompute(group, phiFunction, newProgressMeter());
  116. measureProgress_ = false;
  117. return preComputation;
  118. }
  119. };
  120. /**
  121. * Verifies a Schnorr zero-knowledge proof of knowledge.
  122. *
  123. * @function verify
  124. * @memberof SchnorrProofHandler
  125. * @param {ZeroKnowledgeProof}
  126. * proof The Schnorr zero-knowledge proof of knowledge to verify.
  127. * @param {ZpGroupElement}
  128. * gamma The Zp subgroup generator exponentiated to the secret
  129. * exponent, the knowledge of which must be verified.
  130. * @param {Object}
  131. * [options] An object containing optional arguments.
  132. * @param {Uint8Array|string}
  133. * [options.data=''] Auxiliary data. It must be the same as that
  134. * used to generate the proof.
  135. * @returns {boolean} <code>true</code> if the Schnorr zero-knowledge
  136. * proof of knowledge was verified, <code>false</code> otherwise.
  137. * @throws {Error}
  138. * If the input data validation fails.
  139. */
  140. this.verify = function(proof, gamma, options) {
  141. options = options || {};
  142. checkVerificationData(proof, gamma, options);
  143. var data = options.data;
  144. if (typeof data === 'undefined') {
  145. data = DEFAULT_AUXILIARY_DATA;
  146. }
  147. var voterId = options.voterId;
  148. var electionId = options.electionId;
  149. if (voterId && electionId) {
  150. data = VOTER_ID_PREFIX + voterId + ELECTION_ID_PREFIX + electionId;
  151. }
  152. var phiFunction = newPhiFunction(group);
  153. var publicValues = [gamma];
  154. if (!measureProgress_) {
  155. return verifier_.verify(group, proof, phiFunction, publicValues, data);
  156. } else {
  157. var verified = verifier_.verify(
  158. group, proof, phiFunction, publicValues, data, newProgressMeter());
  159. measureProgress_ = false;
  160. return verified;
  161. }
  162. };
  163. /**
  164. * Indicates that a progress meter is to be used for the next Schnorr
  165. * zero-knowledge proof of knowledge operation to be performed.
  166. *
  167. * @function measureProgress
  168. * @memberof SchnorrProofHandler
  169. * @param {function}
  170. * callback The callback function for the progress meter.
  171. * @param {Object}
  172. * [options] An object containing optional arguments.
  173. * @param {number}
  174. * [minCheckInterval=10] The minimum interval used to check
  175. * progress, as a percentage of the expected final progress
  176. * value..
  177. * @returns {SchnorrProofHandler} A reference to this object, to facilitate
  178. * method chaining.
  179. * @throws {Error}
  180. * If the input data validation fails.
  181. */
  182. this.measureProgress = function(callback, minCheckInterval) {
  183. validator.checkProgressMeterData(
  184. callback, minCheckInterval, 'Schnorr zero-knowledge proof');
  185. progressCallback_ = callback;
  186. progressPercentMinCheckInterval_ = minCheckInterval;
  187. measureProgress_ = true;
  188. return this;
  189. };
  190. function newPhiFunction(group) {
  191. var baseElements = [group.generator];
  192. return new PhiFunction(
  193. NUM_PHI_INPUTS, NUM_PHI_OUTPUTS, COMPUTATION_RULES, baseElements);
  194. }
  195. function newProgressMeter() {
  196. return new ProgressMeter(
  197. NUM_PHI_OUTPUTS, progressCallback_, progressPercentMinCheckInterval_);
  198. }
  199. function checkGenerationData(secret, gamma, options) {
  200. validator.checkExponent(
  201. secret, 'Secret exponent for Schnorr proof generation', group.q);
  202. validator.checkZpGroupElement(
  203. gamma, 'ElGamal gamma Zp group element for Schnorr proof generation',
  204. group);
  205. if (typeof options.data !== 'undefined' &&
  206. typeof options.data !== 'string') {
  207. validator.checkIsInstanceOf(
  208. options.data, Uint8Array, 'Uint8Array',
  209. 'Non-string auxiliary data for Schnorr proof generation');
  210. }
  211. if (typeof options.voterId !== 'undefined') {
  212. validator.checkIsNonEmptyString(
  213. options.voterId, 'Voter ID for Schnorr proof generation');
  214. if (typeof options.electionId === 'undefined') {
  215. throw new Error(
  216. 'Voter ID was provided but no election ID was provided for Schnorr proof generation');
  217. }
  218. }
  219. if (typeof options.electionId !== 'undefined') {
  220. validator.checkIsNonEmptyString(
  221. options.electionId, 'Election ID for Schnorr proof generation');
  222. if (typeof options.voterId === 'undefined') {
  223. throw new Error(
  224. 'Election ID was provided but no voter ID was provided for Schnorr proof generation');
  225. }
  226. }
  227. if (typeof options.preComputation !== 'undefined') {
  228. validator.checkIsInstanceOf(
  229. options.preComputation, ZeroKnowledgeProofPreComputation,
  230. 'ZeroKnowledgeProofPreComputation',
  231. 'Pre-computation for Schnorr proof generation');
  232. }
  233. }
  234. function checkVerificationData(proof, gamma, options) {
  235. validator.checkIsInstanceOf(
  236. proof, ZeroKnowledgeProof, 'ZeroKnowledgeProof',
  237. 'Schnorr zero-knowledge proof');
  238. validator.checkZpGroupElement(
  239. gamma, 'ElGamal gamma Zp group element for Schnorr proof verification',
  240. group);
  241. if (typeof options.data !== 'undefined' &&
  242. typeof options.data !== 'string') {
  243. validator.checkIsInstanceOf(
  244. options.data, Uint8Array, 'Uint8Array',
  245. 'Non-string auxiliary data for Schnorr proof verification');
  246. }
  247. if (typeof options.voterId !== 'undefined') {
  248. validator.checkIsNonEmptyString(
  249. options.voterId, 'Voter ID for Schnorr proof verification');
  250. if (typeof options.electionId === 'undefined') {
  251. throw new Error(
  252. 'Voter ID was provided but no election ID was provided for Schnorr proof verification');
  253. }
  254. }
  255. if (typeof options.electionId !== 'undefined') {
  256. validator.checkIsNonEmptyString(
  257. options.electionId, 'Election ID for Schnorr proof verification');
  258. if (typeof options.voterId === 'undefined') {
  259. throw new Error(
  260. 'Election ID was provided but no voter ID was provided for Schnorr proof verification');
  261. }
  262. }
  263. }
  264. }