/// Create a proof of correct sharing
///
/// See section 6.4 of <https://eprint.iacr.org/2021/339.pdf>
Create a proof of correct sharing
See section 6.4 of
Create a proof of correct sharing See section 6 . 4 of
pub fn prove_sharing(
    instance: &SharingInstance,
    witness: &SharingWitness,
    rng: &mut impl RAND,
) -> ProofSharing {
    //   instance = ([y_1..y_n], [A_0..A_{t-1}], R, [C_1..C_n])
    //   witness = (r, [s_1..s_n])
    instance
        .check_instance()
        .expect("The sharing proof instance is invalid");
    // Hash of instance: x = oracle(instance)
    let x = instance.hash_to_scalar();
    // First move (prover)
    // alpha, rho <- random Z_p
    let alpha: BIG = BIG::randomnum(&curve_order(), rng);
    let rho: BIG = BIG::randomnum(&curve_order(), rng);
    // F = g_1^rho
    // A = g_2^alpha
    // Y = product [y_i^x^i | i <- [1..n]]^rho * g_1^alpha
    let ff: ECP = instance.g1_gen.mul(&rho);
    let aa: ECP2 = instance.g2_gen.mul(&alpha);
    let mut yy: ECP = instance
        .public_keys
        .iter()
        .rev()
        .fold(ecp_inf(), |mut acc, point| {
            acc.add(point);
            acc.mul(&x)
        });
    yy = yy.mul2(&rho, &instance.g1_gen, &alpha);
    let first_move = FirstMoveSharing {
        blinder_g1: ff,
        blinder_g2: aa,
        blinded_instance: yy,
    };
    // Second move (verifier's challenge)
    // x' = oracle(x, F, A, Y)
    let x_challenge: BIG = sharing_proof_challenge(&x, &first_move);
    // Third move (prover)
    // z_r = r * x' + rho mod p
    // z_alpha = x' * sum [s_i*x^i | i <- [1..n]] + alpha mod p
    let mut z_r: BIG = field_mul(&witness.scalar_r, &x_challenge);
    z_r = field_add(&z_r, &rho);
    let mut z_alpha: BIG = witness
        .scalars_s
        .iter()
        .rev()
        .fold(big_zero(), |mut acc, scalar| {
            acc = field_add(&acc, scalar);
            field_mul(&acc, &x)
        });
    z_alpha = field_mul(&z_alpha, &x_challenge);
    z_alpha = field_add(&z_alpha, &alpha);
    ProofSharing {
        ff: first_move.blinder_g1,
        aa: first_move.blinder_g2,
        yy: first_move.blinded_instance,
        z_r,
        z_alpha,
    }
}
pub fn prove_sharing ( instance : & SharingInstance , witness : & SharingWitness , rng : & mut impl RAND , ) -> ProofSharing { //   instance = ([y_1..y_n], [A_0..A_{t-1}], R, [C_1..C_n]) //   witness = (r, [s_1..s_n]) instance . check_instance ( ) . expect ( " " ) ; // Hash of instance: x = oracle(instance) let x = instance . hash_to_scalar ( ) ; // First move (prover) // alpha, rho <- random Z_p let alpha : BIG = BIG :: randomnum ( & curve_order ( ) , rng ) ; let rho : BIG = BIG :: randomnum ( & curve_order ( ) , rng ) ; // F = g_1^rho // A = g_2^alpha // Y = product [y_i^x^i | i <- [1..n]]^rho * g_1^alpha let ff : ECP = instance . g1_gen . mul ( & rho ) ; let aa : ECP2 = instance . g2_gen . mul ( & alpha ) ; let mut yy : ECP = instance . public_keys . iter ( ) . rev ( ) . fold ( ecp_inf ( ) , | mut acc , point | { acc . add ( point ) ; acc . mul ( & x ) } ) ; yy = yy . mul2 ( & rho , & instance . g1_gen , & alpha ) ; let first_move = FirstMoveSharing { blinder_g1 : ff , blinder_g2 : aa , blinded_instance : yy , } ; // Second move (verifier's challenge) // x' = oracle(x, F, A, Y) let x_challenge : BIG = sharing_proof_challenge ( & x , & first_move ) ; // Third move (prover) // z_r = r * x' + rho mod p // z_alpha = x' * sum [s_i*x^i | i <- [1..n]] + alpha mod p let mut z_r : BIG = field_mul ( & witness . scalar_r , & x_challenge ) ; z_r = field_add ( & z_r , & rho ) ; let mut z_alpha : BIG = witness . scalars_s . iter ( ) . rev ( ) . fold ( big_zero ( ) , | mut acc , scalar | { acc = field_add ( & acc , scalar ) ; field_mul ( & acc , & x ) } ) ; z_alpha = field_mul ( & z_alpha , & x_challenge ) ; z_alpha = field_add ( & z_alpha , & alpha ) ; ProofSharing { ff : first_move . blinder_g1 , aa : first_move . blinder_g2 , yy : first_move . blinded_instance , z_r , z_alpha , } }
Create a proof of correct sharing
See section 6.4 of <https://eprint.iacr.org/2021/339.pdf>
Create a proof of correct sharing See section 6 . 4 of <https : // eprint . iacr . org / 2021 / 339 . pdf >
instance
&SharingInstance
witness
&SharingWitness
rng
&mut impl RAND