fin blind sign/verify

Author: klizz111

bbs/src/bbs_bn254/blind.rs

@@ -8,15 +8,16 @@ use ark_serialize::CanonicalSerialize;
 use ark_std::{UniformRand, rand::RngCore};
 use sha2::{Digest, Sha256};
 
-use crate::bbs_bn254::structs::{BlindedCommitment, CommitmentProof, Parameters};
+use crate::bbs_bn254::{Signature, structs::{BlindedCommitment, CommitmentProof, Parameters}};
 
 /// Create a blinded commitment for a list of messages.
 /// Returns `Err` if message length exceeds available parameters.
-/// data with index at and behind `blind_index` will be blinded, should be between 1 and messages.len() - 1
+/// for example, if blind_index is 3, and the length of messages is 5
+/// the m0, m1, m2 are visual, while m3, m4 are blinded, the commitment will be C = r*H_0 + m3*H_4 + m4*H_5
 pub fn blind(
     params: &Parameters,
     messages: &[Scalar],
-    blind_index: usize,
+    blind_index: &usize,
 ) -> Result<BlindedCommitment, &'static str> {
     let mut rng = ark_std::test_rng();
     blind_with_rng(params, messages, blind_index, &mut rng)
@@ -26,7 +27,7 @@ pub fn blind(
 pub fn blind_with_rng<R: RngCore>(
     params: &Parameters,
     messages: &[Scalar],
-    blind_index: usize,
+    blind_index: &usize,
     rng: &mut R,
 ) -> Result<BlindedCommitment, &'static str> {
     if messages.len() > params.L {
@@ -35,7 +36,7 @@ pub fn blind_with_rng<R: RngCore>(
     if params.H.len() < messages.len() + 1 {
         return Err("parameters do not include enough message base points");
     }
-    if blind_index == 0 || blind_index >= messages.len() {
+    if *blind_index > messages.len() {
         return Err("invalid blind index");
     }
 
@@ -44,7 +45,7 @@ pub fn blind_with_rng<R: RngCore>(
     let mut commitment = params.H[0] * blinding_factor;
 
     // calc m_j*H_{j+1}
-    for j in (blind_index - 1)..messages.len() {
+    for j in *blind_index..messages.len() {
         commitment += params.H[j + 1] * messages[j];
     }
 
@@ -54,6 +55,24 @@ pub fn blind_with_rng<R: RngCore>(
     })
 }
 
+pub fn unblind(
+	params: &Parameters,
+	signature: &Signature,
+	commitment: &BlindedCommitment,
+) -> Result<Signature, &'static str> {
+	if params.H.len() < 2 {
+		return Err("parameters do not include enough message base points");
+	}
+
+	let unblinded_s = signature.s + commitment.blinding_factor;
+	return Ok(Signature {
+		A: signature.A,
+		e: signature.e,
+		s: unblinded_s,
+	});
+}
+
+
 /// Generate a proof of knowledge for the blinded commitment.
 pub fn commitment_pok_prove(
     params: &Parameters,
@@ -156,7 +175,7 @@ mod tests {
         let messages = vec![Scalar::from(1u64), Scalar::from(2u64), Scalar::from(3u64)];
 
         let mut rng = ark_std::test_rng();
-        let commitment = blind_with_rng(&params, &messages, 1, &mut rng).unwrap();
+        let commitment = blind_with_rng(&params, &messages, &1, &mut rng).unwrap();
         let proof =
             commitment_pok_prove_with_rng(&params, &commitment, &messages, &mut rng).unwrap();
 

bbs/src/bbs_bn254/mod.rs

@@ -10,5 +10,5 @@ pub use blind::{
     commitment_pok_verify,
 };
 pub use keygen::{keygen, keygen_with_rng};
-pub use signer::sign_no_blind;
+pub use signer::{sign_no_blind, sign_with_blind};
 pub use structs::{Parameters, PrivateKey, PublicKey, Signature};

bbs/src/bbs_bn254/signer.rs

@@ -45,3 +45,54 @@ pub fn sign_no_blind_with_rng<R: RngCore>(
     // Output signature (A, e, s)
     Ok(Signature { A: a, e, s })
 }
+
+
+pub fn sign_with_blind(
+    params: &Parameters,
+    sk: &PrivateKey,
+    blind_index: &usize,
+    commitment: &G1,
+    visual_messages: &[Scalar],
+) -> Result<Signature, &'static str> {
+    let mut rng = test_rng();
+    sign_with_blind_with_rng(params, sk, blind_index, commitment, visual_messages, &mut rng)
+}
+
+pub fn sign_with_blind_with_rng<R: RngCore>(
+    params: &Parameters,
+    sk: &PrivateKey,
+    blind_index: &usize,
+    commitment: &G1,
+    visual_messages: &[Scalar],
+    rng: &mut R,
+) -> Result<Signature, &'static str> {
+    // Check 
+    if visual_messages.len() > params.L {
+        return Err("message length exceeds parameters");
+    }
+    if *blind_index > visual_messages.len() {
+        return Err("invalid blind index");
+    }
+
+    // Sample random scalars e and s'
+    let e = Scalar::rand(rng);
+    let s_prime = Scalar::rand(rng);
+
+    // Construct C' = g_1 + commitment + s'*H_0 + sum(m_i*H_i)
+    let mut c_p = params.g1 + commitment + params.H[0] * s_prime;
+    for (j, m_j) in visual_messages.iter().enumerate() {
+        if j >= params.L {
+            return Err("message length exceeds parameters");
+        }
+        c_p += params.H[j + 1] * m_j;
+    }
+
+    // calc (x + e) ^ (-1)
+    let mut tmp = sk.x + e;
+    tmp = tmp.inverse().ok_or("failed to compute inverse")?;
+
+    // calc A = C' * (x + e) ^ (-1)
+    let a = (c_p * tmp).into_affine() as G1;
+
+    return Ok(Signature { A: a, e, s: s_prime });
+}

bbs/src/bbs_bn254/verify.rs

@@ -42,4 +42,4 @@ pub fn verify_no_blind(
 
     // Check if lhs == rhs
     return Ok(lhs == rhs);
-}
+}

bbs/tests/test_with_blind.rs

@@ -0,0 +1,26 @@
+mod tests {
+    use ark_bn254::Fr as Scalar;
+    use bbs::bbs_bn254::{blind::unblind, verify::verify_no_blind, *};
+    #[test]
+    fn test_no_blind() {
+        let (params, pk, sk) = keygen(5);
+        let messages = vec![
+            Scalar::from(10u64),
+            Scalar::from(20u64),
+            Scalar::from(30u64),
+            Scalar::from(40u64),
+            Scalar::from(50u64),
+        ];
+
+        let commitment = blind(&params, &messages, &3).unwrap();
+
+        // m0, m1, m2 are visual, m3, m4 are blinded
+        let visual_messages = messages[..3].to_vec();
+        let mut signature = sign_with_blind(&params, &sk, &3, &commitment.commitment, &visual_messages).unwrap();
+
+        signature = unblind(&params, &signature, &commitment).unwrap();
+
+        let ok = verify_no_blind(&params, &pk, &messages, &signature).unwrap();
+        assert!(ok);
+    }
+}