/// Verify a proof of correct sharing
///
/// See section 6.4 of <https://eprint.iacr.org/2021/339.pdf>
Verify a proof of correct sharing
See section 6.4 of
Verify a proof of correct sharing See section 6 . 4 of
pub fn verify_sharing(
    instance: &SharingInstance,
    nizk: &ProofSharing,
) -> Result<(), ZkProofSharingError> {
    instance.check_instance()?;
    // Hash of Instance
    // x = oracle(instance)
    let x: BIG = instance.hash_to_scalar();
    let first_move = FirstMoveSharing::from(nizk);
    // Verifier's challenge
    // x' = oracle(x, F, A, Y)
    let x_challenge: BIG = sharing_proof_challenge(&x, &first_move);
    // First verification equation
    // R^x' * F == g_1^z_r
    let mut lhs: ECP = instance.combined_randomizer.mul(&x_challenge);
    lhs.add(&first_move.blinder_g1);
    let rhs = instance.g1_gen.mul(&nizk.z_r);
    if !lhs.equals(&rhs) {
        return Err(ZkProofSharingError::InvalidProof);
    }
    // Second verification equation
    // Verify: product [A_k ^ sum [i^k * x^i | i <- [1..n]] | k <- [0..t-1]]^x' * A
    // == g_2^z_alpha
    let mut kbig: BIG = big_zero();
    let one: BIG = big_one();
    let mut lhs: ECP2 = ecp2_inf();
    instance.public_coefficients.iter().for_each(|aa_k| {
        let mut acc = big_zero();
        let mut xpow = x;
        let mut ibig = big_one();
        instance.public_keys.iter().for_each(|_| {
            let tmp = field_mul(&ibig.powmod(&kbig, &curve_order()), &xpow);
            acc = field_add(&acc, &tmp);
            xpow = field_mul(&xpow, &x);
            ibig = field_add(&ibig, &one);
        });
        lhs.add(&aa_k.mul(&acc));
        kbig = field_add(&kbig, &one);
    });
    lhs = lhs.mul(&x_challenge);
    lhs.add(&nizk.aa);
    let rhs = instance.g2_gen.mul(&nizk.z_alpha);
    if !lhs.equals(&rhs) {
        return Err(ZkProofSharingError::InvalidProof);
    }
    // Third verification equation
    // LHS = product [C_i ^ x^i | i <- [1..n]]^x' * Y
    // RHS = product [y_i ^ x^i | i <- 1..n]^z_r * g_1^z_alpha
    let mut lhs: ECP =
        instance
            .combined_ciphertexts
            .iter()
            .rev()
            .fold(ecp_inf(), |mut acc, point| {
                acc.add(point);
                acc.mul(&x)
            });
    lhs = lhs.mul(&x_challenge);
    lhs.add(&nizk.yy);
    let mut rhs: ECP = instance
        .public_keys
        .iter()
        .rev()
        .fold(ecp_inf(), |mut acc, point| {
            acc.add(point);
            acc.mul(&x)
        });
    rhs = rhs.mul2(&nizk.z_r, &instance.g1_gen, &nizk.z_alpha);
    if !lhs.equals(&rhs) {
        return Err(ZkProofSharingError::InvalidProof);
    }
    Ok(())
}
pub fn verify_sharing ( instance : & SharingInstance , nizk : & ProofSharing , ) -> Result < ( ) , ZkProofSharingError > { instance . check_instance ( ) ? ; // Hash of Instance // x = oracle(instance) let x : BIG = instance . hash_to_scalar ( ) ; let first_move = FirstMoveSharing :: from ( nizk ) ; // Verifier's challenge // x' = oracle(x, F, A, Y) let x_challenge : BIG = sharing_proof_challenge ( & x , & first_move ) ; // First verification equation // R^x' * F == g_1^z_r let mut lhs : ECP = instance . combined_randomizer . mul ( & x_challenge ) ; lhs . add ( & first_move . blinder_g1 ) ; let rhs = instance . g1_gen . mul ( & nizk . z_r ) ; if ! lhs . equals ( & rhs ) { return Err ( ZkProofSharingError :: InvalidProof ) ; } // Second verification equation // Verify: product [A_k ^ sum [i^k * x^i | i <- [1..n]] | k <- [0..t-1]]^x' * A // == g_2^z_alpha let mut kbig : BIG = big_zero ( ) ; let one : BIG = big_one ( ) ; let mut lhs : ECP2 = ecp2_inf ( ) ; instance . public_coefficients . iter ( ) . for_each ( | aa_k | { let mut acc = big_zero ( ) ; let mut xpow = x ; let mut ibig = big_one ( ) ; instance . public_keys . iter ( ) . for_each ( | _ | { let tmp = field_mul ( & ibig . powmod ( & kbig , & curve_order ( ) ) , & xpow ) ; acc = field_add ( & acc , & tmp ) ; xpow = field_mul ( & xpow , & x ) ; ibig = field_add ( & ibig , & one ) ; } ) ; lhs . add ( & aa_k . mul ( & acc ) ) ; kbig = field_add ( & kbig , & one ) ; } ) ; lhs = lhs . mul ( & x_challenge ) ; lhs . add ( & nizk . aa ) ; let rhs = instance . g2_gen . mul ( & nizk . z_alpha ) ; if ! lhs . equals ( & rhs ) { return Err ( ZkProofSharingError :: InvalidProof ) ; } // Third verification equation // LHS = product [C_i ^ x^i | i <- [1..n]]^x' * Y // RHS = product [y_i ^ x^i | i <- 1..n]^z_r * g_1^z_alpha let mut lhs : ECP = instance . combined_ciphertexts . iter ( ) . rev ( ) . fold ( ecp_inf ( ) , | mut acc , point | { acc . add ( point ) ; acc . mul ( & x ) } ) ; lhs = lhs . mul ( & x_challenge ) ; lhs . add ( & nizk . yy ) ; let mut rhs : ECP = instance . public_keys . iter ( ) . rev ( ) . fold ( ecp_inf ( ) , | mut acc , point | { acc . add ( point ) ; acc . mul ( & x ) } ) ; rhs = rhs . mul2 ( & nizk . z_r , & instance . g1_gen , & nizk . z_alpha ) ; if ! lhs . equals ( & rhs ) { return Err ( ZkProofSharingError :: InvalidProof ) ; } Ok ( ( ) ) }
Verify a proof of correct sharing
See section 6.4 of <https://eprint.iacr.org/2021/339.pdf>
Verify a proof of correct sharing See section 6 . 4 of <https : // eprint . iacr . org / 2021 / 339 . pdf >
instance
&SharingInstance
nizk
&ProofSharing