search

plume-sig / zk-nullifier-sig

Implementation of PLUME: nullifier friendly signature scheme on ECDSA
MIT License
132 stars 22 forks source link

Equivalence with the arkworks reference implementation #1

Closed weijiekoh closed 2 years ago

weijiekoh commented 2 years ago

I've implemented the signature scheme in arkworks: https://github.com/geometryresearch/deterministic_nullifier_sigs

This PR makes some changes to make the k256-based implementation equivalent to the above arkworks implementation.

  1. I implemented a pt_to_64_bytes() function which encodes a secp256k1 point as 64 bytes. This is less than ideal (as SEC1 encoding, which k256 provides, outputs fewer bytes), but until SEC1 encoding is implemented for secp256k1 in arkworks, it will do.
  2. The input to the sha512 is now a concatenated byte array of the relevant values. Previously, hasher.update() was invoked once per value.
  3. The input to Secp256k1::hash_from_bytes() is now a concatenated byte array of the message and the public key (encoded as 64 bytes - see above). Previously, it was an array of two byte arrays.
  4. The main program outputs each value in the signature. The arkworks reference implementation contains tests which checks against said values (given the same hardcoded secret key and r).
Verified: true
nullifier.x: "09087d02121b2cebf2ed5b25674753d7e5a52b60b86e15488ebdbc28646b6ade"
nullifier.y: "c964a5d8a292a8878d1c52cb91c5173c2d15eff720d2b4d135b69bd165457597"
c: "d52d5492448ee7aafd7d7bfff39d9819954c54f8e2517e29a07d299d268e3a11"
r_sk_c: "2c079c66390abbf6cd11190905084391fead39fde8f491bd4a53fdf767a5cc5f"
g_r.x: "9d8ca4350e7e2ad27abc6d2a281365818076662962a28429590e2dc736fe9804"
g_r.y: "ff08c30b8afd4e854623c835d9c3aac6bcebe45112472d9b9054816a7670c5a1"
hash_m_pk_pow_r.x: "cb5948e1ba7f305da52f846c345d880a1cb7ca2c9924d2ce92134a5a20daaea7"
hash_m_pk_pow_r.y: "153a05bf994bfbc6ef39e267f69edc00aeaaf505ec43ff278a2f1ca11e0edda9"