misc fixes

Author: lovesh

Cargo.lock

@@ -25,8 +25,8 @@ ark-dlog-gadget = { package = "ark-dlog-gadget", git = "https://github.com/Polym
 
 #dock_crypto_utils = { path = "../crypto/utils" }
 #schnorr_pok = { path = "../crypto/schnorr_pok" }
-dock_crypto_utils = { git = "https://github.com/PolymeshAssociation/crypto", branch = "patch30" }
-schnorr_pok = { git = "https://github.com/PolymeshAssociation/crypto", branch = "patch30" }
+dock_crypto_utils = { git = "https://github.com/PolymeshAssociation/crypto", branch = "main" }
+schnorr_pok = { git = "https://github.com/PolymeshAssociation/crypto", branch = "main" }
 
 # Polymesh changes.
 #ark-serialize = { path = "../arkworks-algebra/serialize" }

Cargo.toml

@@ -279,9 +279,13 @@ with $r_{\mathrm{old},D} + r_{\mathrm{old},H} = b_0$ (so old partials sum to $\m
    $$T_{P_{\mathrm{new},D}} = \mathrm{sk}_r \cdot G_{\mathrm{Aff}} + \mathrm{ek}_r \cdot G_{\mathrm{Enc}} + r_{\mathrm{new},D_r} \cdot H_0$$
 2. **D-relation** (replaces the $\mathrm{ek} \cdot \mathrm{ek}^{-1} = 1$ BP constraint). Pick fresh $r \in \mathbb{Z}_p$ and compute
    $$D = G_{\mathrm{Enc}} \cdot \mathrm{ek} + H_0 \cdot r$$
-   Since $G_{\mathrm{Enc}} = D \cdot \mathrm{ek}^{-1} + H_0 \cdot (-r \cdot \mathrm{ek}^{-1})$, the device proves knowledge of $(\mathrm{ek}^{-1}, -r \cdot \mathrm{ek}^{-1})$ in this relation. Pick blindings $(\mathrm{ek}^{-1})_r, (-r \cdot \mathrm{ek}^{-1})_r$:
-   $$T_D = D \cdot (\mathrm{ek}^{-1})_r + H_0 \cdot (-r \cdot \mathrm{ek}^{-1})_r$$
-   The blinding $r$ hides $\mathrm{ek}$ in $D$. This Sigma proof binds $\mathrm{ek}^{-1}$ to the true inverse of $\mathrm{ek}$ in $D$, and the $\mathrm{ek}^{-1}$ response is reused as the bridging element in all per-leg ciphertext checks below.
+   The blinding $r$ hides $\mathrm{ek}$ in $D$. The device proves two things about $D$:
+   - **$D$ opening.** Knowledge of $(\mathrm{ek}, r)$ in $D = G_{\mathrm{Enc}} \cdot \mathrm{ek} + H_0 \cdot r$, reusing the account partials' $\mathrm{ek}_r$ (step 1) so the $\mathrm{ek}$ response $s_{\mathrm{ek}}$ is shared. Pick a blinding $r_r$:
+     $$T_D = G_{\mathrm{Enc}} \cdot \mathrm{ek}_r + H_0 \cdot r_r$$
+     The shared $s_{\mathrm{ek}}$ binds the $\mathrm{ek}$ inside $D$ to the account's $\mathrm{ek}$; without it the device could open $D$ with an arbitrary key.
+   - **Inverse relation.** Since $G_{\mathrm{Enc}} = D \cdot \mathrm{ek}^{-1} + H_0 \cdot (-r \cdot \mathrm{ek}^{-1})$, knowledge of $(\mathrm{ek}^{-1}, -r \cdot \mathrm{ek}^{-1})$ in it. Pick blindings $(\mathrm{ek}^{-1})_r, (-r \cdot \mathrm{ek}^{-1})_r$:
+     $$T_{G_{\mathrm{Enc}}} = D \cdot (\mathrm{ek}^{-1})_r + H_0 \cdot (-r \cdot \mathrm{ek}^{-1})_r$$
+     Given $D$ opens to the account's $\mathrm{ek}$, this forces $\mathrm{ek} \cdot \mathrm{ek}^{-1} = 1$, so $\mathrm{ek}^{-1}$ is the true inverse. The $\mathrm{ek}^{-1}$ response is reused as the bridging element in all per-leg ciphertext checks below.
 3. **Per-leg amount partial** (when the asset-id is revealed in this leg, or the balance changes). Pick fresh $k_{\mathrm{amt}} \in \mathbb{Z}_p$ and a blinding $k_{\mathrm{amt},r}$, publish
    $$P_{\mathrm{ct}_{\mathrm{amt}},D} = H_0 \cdot k_{\mathrm{amt}} + \mathrm{eph\_pk}_{\mathrm{amt}} \cdot \mathrm{ek}^{-1}$$
    $$T_{P_{\mathrm{ct}_{\mathrm{amt}},D}} = H_0 \cdot k_{\mathrm{amt},r} + \mathrm{eph\_pk}_{\mathrm{amt}} \cdot (\mathrm{ek}^{-1})_r$$
@@ -295,9 +299,10 @@ with $r_{\mathrm{old},D} + r_{\mathrm{old},H} = b_0$ (so old partials sum to $\m
 5. Device hashes its transcript — containing $\mathrm{nonce}$, $P_{\mathrm{old},D}, P_{\mathrm{new},D}, D$, the per-leg partials $P_{\mathrm{ct}_{\mathrm{amt}},D}, P_{\mathrm{ct\_at},D}$, the leg encryptions, and all $T$ values above — to derive challenge $c$.
 6. Device responses:
    - $s_{\mathrm{sk}} = \mathrm{sk}_r + \mathrm{sk} \cdot c$ (shared across both account partials)
-   - $s_{\mathrm{ek}} = \mathrm{ek}_r + \mathrm{ek} \cdot c$ (shared across both account partials)
+   - $s_{\mathrm{ek}} = \mathrm{ek}_r + \mathrm{ek} \cdot c$ (shared across both account partials and the $D$ opening)
    - $s_{r_{\mathrm{old},D}} = r_{\mathrm{old},D_r} + r_{\mathrm{old},D} \cdot c$, $\quad s_{r_{\mathrm{new},D}} = r_{\mathrm{new},D_r} + r_{\mathrm{new},D} \cdot c$
-   - $s_{\mathrm{ek}^{-1}} = (\mathrm{ek}^{-1})_r + \mathrm{ek}^{-1} \cdot c$ (shared across the D-relation, the per-leg amount partial, and the per-leg asset-id)
+   - $s_r = r_r + r \cdot c$ (for the $D$ opening)
+   - $s_{\mathrm{ek}^{-1}} = (\mathrm{ek}^{-1})_r + \mathrm{ek}^{-1} \cdot c$ (shared across the inverse relation, the per-leg amount partial, and the per-leg asset-id)
    - $s_{-r \cdot \mathrm{ek}^{-1}} = (-r \cdot \mathrm{ek}^{-1})_r + (-r \cdot \mathrm{ek}^{-1}) \cdot c$
    - Per leg with a $\mathrm{ct}_{\mathrm{amt}}$ partial: $s_{k_{\mathrm{amt}}} = k_{\mathrm{amt},r} + k_{\mathrm{amt}} \cdot c$
    - Per leg with hidden asset-id: $s_{k_{\mathrm{at}}} = k_{\mathrm{at},r} + k_{\mathrm{at}} \cdot c$
@@ -307,7 +312,8 @@ with $r_{\mathrm{old},D} + r_{\mathrm{old},H} = b_0$ (so old partials sum to $\m
 The verifier recomputes $c$ from the device's transcript and checks each Sigma relation. Each check has the standard structure $\text{(linear combination of responses)} \stackrel{?}{=} T + \text{(committed value)}.c$:
 - $s_{\mathrm{sk}} \cdot G_{\mathrm{Aff}} + s_{\mathrm{ek}} \cdot G_{\mathrm{Enc}} + s_{r_{\mathrm{old},D}} \cdot H_0 \stackrel{?}{=} T_{P_{\mathrm{old},D}} + P_{\mathrm{old},D} \cdot c$
 - $s_{\mathrm{sk}} \cdot G_{\mathrm{Aff}} + s_{\mathrm{ek}} \cdot G_{\mathrm{Enc}} + s_{r_{\mathrm{new},D}} \cdot H_0 \stackrel{?}{=} T_{P_{\mathrm{new},D}} + P_{\mathrm{new},D} \cdot c$
-- $s_{\mathrm{ek}^{-1}} \cdot D + s_{-r \cdot \mathrm{ek}^{-1}} \cdot H_0 \stackrel{?}{=} T_D + G_{\mathrm{Enc}} \cdot c$
+- $D$ opening: $s_{\mathrm{ek}} \cdot G_{\mathrm{Enc}} + s_r \cdot H_0 \stackrel{?}{=} T_D + D \cdot c$
+- Inverse relation: $s_{\mathrm{ek}^{-1}} \cdot D + s_{-r \cdot \mathrm{ek}^{-1}} \cdot H_0 \stackrel{?}{=} T_{G_{\mathrm{Enc}}} + G_{\mathrm{Enc}} \cdot c$
 - Per leg with a $\mathrm{ct}_{\mathrm{amt}}$ partial (asset-id revealed in this leg, or balance changes): $s_{\mathrm{ek}^{-1}} \cdot \mathrm{eph\_pk}_{\mathrm{amt}} + s_{k_{\mathrm{amt}}} \cdot H_0 \stackrel{?}{=} T_{P_{\mathrm{ct}_{\mathrm{amt}},D}} + P_{\mathrm{ct}_{\mathrm{amt}},D} \cdot c$
 - Per leg with hidden asset-id: $s_{\mathrm{ek}^{-1}} \cdot \mathrm{eph\_pk}_{\mathrm{asset\_id}} + s_{k_{\mathrm{at}}} \cdot H_0 \stackrel{?}{=} T_{P_{\mathrm{ct\_at},D}} + P_{\mathrm{ct\_at},D} \cdot c$
 - Per leg with asset-id revealed elsewhere: $s_{\mathrm{ek}^{-1}} \cdot \mathrm{eph\_pk}_{\mathrm{asset\_id}} \stackrel{?}{=} T_{\mathrm{at},\mathrm{DL}} + (\mathrm{CT}_{\mathrm{at}} - \mathrm{at} \cdot H) \cdot c$

dart-bp/docs/5.md

@@ -838,7 +838,7 @@ impl<
             );
         }
 
-        let (nullifier, comm_bp, comm_bp_blinding, t_null, t_bp) = create_bp_and_null_t_values(
+        let (nullifier, comm_bp, comm_bp_blinding, t_null, t_bp, _) = create_bp_and_null_t_values(
             rng,
             false, // include_sk: host mode
             account.rho(),

dart-bp/src/account/common/mod.rs

@@ -355,11 +355,12 @@ macro_rules! impl_txn_proof {
                 rng: &mut R,
                 rmc: Option<&mut RandomizedMultChecker<Affine<G0>>>,
             ) -> Result<(VerificationTuple<Affine<G0>>, VerificationTuple<Affine<G1>>)> {
+                let (leg_enc_core, eph_pk) = leg_enc;
                 let mut verifier = StateChangeVerifier::init::<Parameters0, Parameters1>(
                     &self.common_proof,
                     vec![LegVerifierConfig {
-                        encryption: leg_enc.0.clone(),
-                        party_eph_pk: PartyEphemeralPublicKey::$EphPkVariant(leg_enc.1.clone()),
+                        encryption: leg_enc_core,
+                        party_eph_pk: PartyEphemeralPublicKey::$EphPkVariant(eph_pk),
                         has_balance_decreased: $ver_bal_dec,
                         has_counter_decreased: $ver_ctr_dec,
                     }],

dart-bp/src/account/mod.rs

@@ -10685,6 +10685,7 @@ fn send_txn_split_proof() {
         );
         println!("split proof size = {}", split_proof.compressed_size());
 
+        let clock = Instant::now();
         let (even_tuple, odd_tuple) = verify_split_proof!(
             proof: split_proof,
             party: Sender,
@@ -10702,11 +10703,7 @@ fn send_txn_split_proof() {
             rng: &mut rng,
         );
         verify_given_verification_tuples(even_tuple, odd_tuple, &account_tree_params).unwrap();
-
-        println!(
-            "reveal_asset_id={}, full verification passed!",
-            reveal_asset_id
-        );
+        let verifier_time = clock.elapsed();
 
         // Sequential flow
         let (split_proof_seq, nullifier_seq, _) = gen_split_proof!(
@@ -10733,6 +10730,7 @@ fn send_txn_split_proof() {
             b_blinding: b_blinding,
             reveal_asset_id: reveal_asset_id,
         );
+        let clock = Instant::now();
         let (even_tuple_seq, odd_tuple_seq) = verify_split_proof!(
             sequential;
             proof: split_proof_seq,
@@ -10752,6 +10750,12 @@ fn send_txn_split_proof() {
         );
         verify_given_verification_tuples(even_tuple_seq, odd_tuple_seq, &account_tree_params)
             .unwrap();
+        let verifier_time_seq = clock.elapsed();
+
+        println!(
+            "total prover time = {:?}, total verifier time (parallel W2) = {:?}, verifier time (sequential W3) = {:?}",
+            host_proof_time, verifier_time, verifier_time_seq
+        );
     };
 
     // asset-id hidden
@@ -10839,6 +10843,7 @@ fn receive_txn_split_proof() {
         );
         println!("split proof size = {}", split_proof.compressed_size());
 
+        let clock = Instant::now();
         let (even_tuple, odd_tuple) = verify_split_proof!(
             proof: split_proof,
             party: Receiver,
@@ -10856,11 +10861,7 @@ fn receive_txn_split_proof() {
             rng: &mut rng,
         );
         verify_given_verification_tuples(even_tuple, odd_tuple, &account_tree_params).unwrap();
-
-        println!(
-            "reveal_asset_id={}, full verification passed!",
-            reveal_asset_id
-        );
+        let verifier_time = clock.elapsed();
 
         // Sequential flow
         let (split_proof_seq, nullifier_seq, _) = gen_split_proof!(
@@ -10887,6 +10888,7 @@ fn receive_txn_split_proof() {
             b_blinding: b_blinding,
             reveal_asset_id: reveal_asset_id,
         );
+        let clock = Instant::now();
         let (even_tuple_seq, odd_tuple_seq) = verify_split_proof!(
             sequential;
             proof: split_proof_seq,
@@ -10906,6 +10908,12 @@ fn receive_txn_split_proof() {
         );
         verify_given_verification_tuples(even_tuple_seq, odd_tuple_seq, &account_tree_params)
             .unwrap();
+        let verifier_time_seq = clock.elapsed();
+
+        println!(
+            "total prover time = {:?}, total verifier time (parallel W2) = {:?}, verifier time (sequential W3) = {:?}",
+            host_proof_time, verifier_time, verifier_time_seq
+        );
     };
 
     // asset-id hidden