Merge branch 'main' into minor-update

Signed-off-by: Michele Orrù <[email protected]>

Author: mmaker

src/composition.rs

@@ -123,7 +123,7 @@ impl<G: Group + GroupEncoding> SigmaProtocol for Protocol<G> {
             }
             (Protocol::And(ps), ProtocolWitness::And(ws)) => {
                 if ps.len() != ws.len() {
-                    return Err(Error::ProofSizeMismatch);
+                    return Err(Error::InvalidInstanceWitnessPair);
                 }
                 let mut commitments = Vec::with_capacity(ps.len());
                 let mut prover_states = Vec::with_capacity(ps.len());
@@ -178,7 +178,7 @@ impl<G: Group + GroupEncoding> SigmaProtocol for Protocol<G> {
                 .map(ProtocolResponse::Simple),
             (Protocol::And(ps), ProtocolProverState::And(states)) => {
                 if ps.len() != states.len() {
-                    return Err(Error::ProofSizeMismatch);
+                    return Err(Error::InvalidInstanceWitnessPair);
                 }
                 let responses: Result<Vec<_>, _> = ps
                     .iter()

src/errors.rs

@@ -17,11 +17,9 @@ pub enum Error {
     /// The proof is invalid: verification failed.
     #[error("Verification failed.")]
     VerificationFailure,
-
-    /// The sizes of input parameters (e.g., witnesses, commitments) do not match expected values.
-    #[error("Mismatched parameter sizes in proof or batch verification.")]
-    ProofSizeMismatch,
-
+    /// Indicates an invalid statement/witness pair
+    #[error("Invalid instance/witness pair.")]
+    InvalidInstanceWitnessPair,
     /// Uninitialized group element variable.
     #[error("Uninitialized group element variable: {var_debug}")]
     UnassignedGroupVar {

src/fiat_shamir.rs

@@ -45,7 +45,7 @@ where
     /// Current codec state.
     pub hash_state: C,
     /// Underlying interactive proof.
-    pub ip: P,
+    pub interactive_proof: P,
 }
 
 impl<P, C> NISigmaProtocol<P, C>
@@ -70,15 +70,15 @@ where
         );
         Self {
             hash_state,
-            ip: interactive_proof,
+            interactive_proof,
         }
     }
 
-    pub fn from_iv(iv: [u8; 32], instance: P) -> Self {
+    pub fn from_iv(iv: [u8; 32], interactive_proof: P) -> Self {
         let hash_state = C::from_iv(iv);
         Self {
             hash_state,
-            ip: instance,
+            interactive_proof,
         }
     }
 
@@ -106,15 +106,16 @@ where
     ) -> Result<Transcript<P>, Error> {
         let mut hash_state = self.hash_state.clone();
 
-        let (commitment, prover_state) = self.ip.prover_commit(witness, rng)?;
+        let (commitment, prover_state) = self.interactive_proof.prover_commit(witness, rng)?;
         // Fiat Shamir challenge
-        let serialized_commitment = self.ip.serialize_commitment(&commitment);
+        let serialized_commitment = self.interactive_proof.serialize_commitment(&commitment);
         hash_state.prover_message(&serialized_commitment);
         let challenge = hash_state.verifier_challenge();
         // Prover's response
-        let response = self.ip.prover_response(prover_state, &challenge)?;
+        let response = self.interactive_proof.prover_response(prover_state, &challenge)?;
+
         // Local verification of the proof
-        self.ip.verifier(&commitment, &challenge, &response)?;
+        debug_assert!(self.interactive_proof.verifier(&commitment, &challenge, &response).is_ok());
         Ok((commitment, challenge, response))
     }
 
@@ -142,12 +143,12 @@ where
         let mut hash_state = self.hash_state.clone();
 
         // Recompute the challenge
-        let serialized_commitment = self.ip.serialize_commitment(commitment);
+        let serialized_commitment = self.interactive_proof.serialize_commitment(commitment);
         hash_state.prover_message(&serialized_commitment);
         let expected_challenge = hash_state.verifier_challenge();
         // Verification of the proof
         match *challenge == expected_challenge {
-            true => self.ip.verifier(commitment, challenge, response),
+            true => self.interactive_proof.verifier(commitment, challenge, response),
             false => Err(Error::VerificationFailure),
         }
     }
@@ -169,8 +170,8 @@ where
     ) -> Result<Vec<u8>, Error> {
         let (commitment, _challenge, response) = self.prove(witness, rng)?;
         let mut bytes = Vec::new();
-        bytes.extend_from_slice(&self.ip.serialize_commitment(&commitment));
-        bytes.extend_from_slice(&self.ip.serialize_response(&response));
+        bytes.extend_from_slice(&self.interactive_proof.serialize_commitment(&commitment));
+        bytes.extend_from_slice(&self.interactive_proof.serialize_response(&response));
         Ok(bytes)
     }
 
@@ -188,18 +189,18 @@ where
     ///   - The challenge doesn't match the recomputed one from the commitment.
     ///   - The response fails verification under the Sigma protocol.
     pub fn verify_batchable(&self, proof: &[u8]) -> Result<(), Error> {
-        let commitment = self.ip.deserialize_commitment(proof)?;
-        let commitment_size = self.ip.serialize_commitment(&commitment).len();
-        let response = self.ip.deserialize_response(&proof[commitment_size..])?;
+        let commitment = self.interactive_proof.deserialize_commitment(proof)?;
+        let commitment_size = self.interactive_proof.serialize_commitment(&commitment).len();
+        let response = self.interactive_proof.deserialize_response(&proof[commitment_size..])?;
 
         let mut hash_state = self.hash_state.clone();
 
         // Recompute the challenge
-        let serialized_commitment = self.ip.serialize_commitment(&commitment);
+        let serialized_commitment = self.interactive_proof.serialize_commitment(&commitment);
         hash_state.prover_message(&serialized_commitment);
         let challenge = hash_state.verifier_challenge();
         // Verification of the proof
-        self.ip.verifier(&commitment, &challenge, &response)
+        self.interactive_proof.verifier(&commitment, &challenge, &response)
     }
 }
 
@@ -229,8 +230,8 @@ where
     ) -> Result<Vec<u8>, Error> {
         let (_commitment, challenge, response) = self.prove(witness, rng)?;
         let mut bytes = Vec::new();
-        bytes.extend_from_slice(&self.ip.serialize_challenge(&challenge));
-        bytes.extend_from_slice(&self.ip.serialize_response(&response));
+        bytes.extend_from_slice(&self.interactive_proof.serialize_challenge(&challenge));
+        bytes.extend_from_slice(&self.interactive_proof.serialize_response(&response));
         Ok(bytes)
     }
 
@@ -251,12 +252,12 @@ where
     ///   - The recomputed commitment or response is invalid under the Sigma protocol.
     pub fn verify_compact(&self, proof: &[u8]) -> Result<(), Error> {
         // Deserialize challenge and response from compact proof
-        let challenge = self.ip.deserialize_challenge(proof)?;
-        let challenge_size = self.ip.serialize_challenge(&challenge).len();
-        let response = self.ip.deserialize_response(&proof[challenge_size..])?;
+        let challenge = self.interactive_proof.deserialize_challenge(proof)?;
+        let challenge_size = self.interactive_proof.serialize_challenge(&challenge).len();
+        let response = self.interactive_proof.deserialize_response(&proof[challenge_size..])?;
 
         // Compute the commitments
-        let commitment = self.ip.simulate_commitment(&challenge, &response)?;
+        let commitment = self.interactive_proof.simulate_commitment(&challenge, &response)?;
         // Verify the proof
         self.verify(&commitment, &challenge, &response)
     }

src/linear_relation/convert.rs

@@ -0,0 +1,142 @@
+use ff::Field;
+use group::Group;
+
+use super::{GroupVar, ScalarTerm, ScalarVar, Sum, Term, Weighted};
+
+impl<G> From<ScalarVar<G>> for ScalarTerm<G> {
+    fn from(value: ScalarVar<G>) -> Self {
+        Self::Var(value)
+    }
+}
+
+impl<G: Group> From<ScalarVar<G>> for Weighted<ScalarTerm<G>, G::Scalar> {
+    fn from(value: ScalarVar<G>) -> Self {
+        ScalarTerm::from(value).into()
+    }
+}
+
+impl<G: Group> From<Weighted<ScalarVar<G>, G::Scalar>> for Weighted<ScalarTerm<G>, G::Scalar> {
+    fn from(value: Weighted<ScalarVar<G>, G::Scalar>) -> Self {
+        Self {
+            term: value.term.into(),
+            weight: value.weight,
+        }
+    }
+}
+
+// NOTE: Rust does not accept an impl over From<G::Scalar>
+impl<T: Field + Into<G::Scalar>, G: Group> From<T> for Weighted<ScalarTerm<G>, G::Scalar> {
+    fn from(value: T) -> Self {
+        Self {
+            term: ScalarTerm::Unit,
+            weight: value.into(),
+        }
+    }
+}
+
+impl<G> From<(ScalarVar<G>, GroupVar<G>)> for Term<G> {
+    fn from((scalar, elem): (ScalarVar<G>, GroupVar<G>)) -> Self {
+        Self {
+            scalar: scalar.into(),
+            elem,
+        }
+    }
+}
+
+impl<G> From<(ScalarTerm<G>, GroupVar<G>)> for Term<G> {
+    fn from((scalar, elem): (ScalarTerm<G>, GroupVar<G>)) -> Self {
+        Self { scalar, elem }
+    }
+}
+
+impl<G> From<GroupVar<G>> for Term<G> {
+    fn from(value: GroupVar<G>) -> Self {
+        Term {
+            scalar: ScalarTerm::Unit,
+            elem: value,
+        }
+    }
+}
+
+impl<G: Group> From<(ScalarVar<G>, GroupVar<G>)> for Weighted<Term<G>, G::Scalar> {
+    fn from(pair: (ScalarVar<G>, GroupVar<G>)) -> Self {
+        Term::from(pair).into()
+    }
+}
+
+impl<G: Group> From<(ScalarTerm<G>, GroupVar<G>)> for Weighted<Term<G>, G::Scalar> {
+    fn from(pair: (ScalarTerm<G>, GroupVar<G>)) -> Self {
+        Term::from(pair).into()
+    }
+}
+
+impl<G: Group> From<GroupVar<G>> for Weighted<Term<G>, G::Scalar> {
+    fn from(value: GroupVar<G>) -> Self {
+        Term::from(value).into()
+    }
+}
+
+impl<G: Group> From<Weighted<GroupVar<G>, G::Scalar>> for Weighted<Term<G>, G::Scalar> {
+    fn from(value: Weighted<GroupVar<G>, G::Scalar>) -> Self {
+        Weighted {
+            term: value.term.into(),
+            weight: value.weight,
+        }
+    }
+}
+
+impl<T, F: Field> From<T> for Weighted<T, F> {
+    fn from(term: T) -> Self {
+        Self {
+            term,
+            weight: F::ONE,
+        }
+    }
+}
+
+// NOTE: This is implemented directly for each of the key types to avoid collision with the blanket
+// Into impl provided by the standard library.
+macro_rules! impl_from_for_sum {
+    ($($type:ty),+) => {
+        $(
+        impl<G: Group, T: Into<$type>> From<T> for Sum<$type> {
+            fn from(value: T) -> Self {
+                Sum(vec![value.into()])
+            }
+        }
+
+        impl<G: Group, T: Into<$type>> From<Vec<T>> for Sum<$type> {
+            fn from(terms: Vec<T>) -> Self {
+                Self::from_iter(terms)
+            }
+        }
+
+        impl<G: Group, T: Into<$type>, const N: usize> From<[T; N]> for Sum<$type> {
+            fn from(terms: [T; N]) -> Self {
+                Self::from_iter(terms)
+            }
+        }
+
+        impl<G: Group, T: Into<$type>> FromIterator<T> for Sum<$type> {
+            fn from_iter<I: IntoIterator<Item = T>>(iter: I) -> Self {
+                Self(iter.into_iter().map(|x| x.into()).collect())
+            }
+        }
+        )+
+    };
+}
+
+impl_from_for_sum!(
+    ScalarVar<G>,
+    GroupVar<G>,
+    Term<G>,
+    Weighted<ScalarVar<G>, G::Scalar>,
+    Weighted<GroupVar<G>, G::Scalar>,
+    Weighted<Term<G>, G::Scalar>
+);
+
+impl<T, F: Field> From<Sum<T>> for Sum<Weighted<T, F>> {
+    fn from(sum: Sum<T>) -> Self {
+        Self(sum.0.into_iter().map(|x| x.into()).collect())
+    }
+}