wip: nonlinear relation handling in SchnorrProof (#63)

nougzarm · web-flow · commit 6be467f22686 · 2025-07-21T01:17:08.000+02:00
diff --git a/src/schnorr_protocol.rs b/src/schnorr_protocol.rs
@@ -147,11 +147,13 @@ where
         }
 
         let lhs = self.0.linear_map.evaluate(response)?;
+        let zero_vec = vec![<<G as Group>::Scalar as Field>::ZERO; self.0.linear_map.num_scalars];
+        let zero_image = self.0.linear_map.evaluate(&zero_vec)?;
         let mut rhs = Vec::new();
         for (i, g) in commitment.iter().enumerate() {
             rhs.push({
                 let image_var = self.0.image[i];
-                self.0.linear_map.group_elements.get(image_var)? * challenge + g
+                (self.0.linear_map.group_elements.get(image_var)? - zero_image[i]) * challenge + g
             });
         }
         if lhs == rhs {
@@ -322,13 +324,16 @@ where
             return Err(Error::InvalidInstanceWitnessPair);
         }
 
+        let zero_vec = vec![<<G as Group>::Scalar as Field>::ZERO; self.0.linear_map.num_scalars];
+        let zero_image = self.0.linear_map.evaluate(&zero_vec)?;
         let response_image = self.0.linear_map.evaluate(response)?;
         let image = self.0.image()?;
 
         let commitment = response_image
             .iter()
             .zip(&image)
-            .map(|(res, img)| *res - *img * challenge)
+            .zip(&zero_image)
+            .map(|((res, img), z_img)| *res - (*img - *z_img) * challenge)
             .collect::<Vec<_>>();
         Ok(commitment)
     }
diff --git a/src/tests/relations.rs b/src/tests/relations.rs
@@ -5,7 +5,7 @@ use rand::rngs::OsRng;
 use crate::fiat_shamir::NISigmaProtocol;
 use crate::tests::test_utils::{
     bbs_blind_commitment_computation, discrete_logarithm, dleq, pedersen_commitment,
-    pedersen_commitment_dleq,
+    pedersen_commitment_dleq, translated_discrete_logarithm, translated_dleq,
 };
 use crate::{codec::ShakeCodec, schnorr_protocol::SchnorrProof};
 
@@ -17,12 +17,24 @@ fn test_discrete_logarithm() {
     discrete_logarithm::<G>(Scalar::random(&mut rng));
 }
 
+#[test]
+fn test_translated_discrete_logarithm() {
+    let mut rng = OsRng;
+    translated_discrete_logarithm::<G>(Scalar::random(&mut rng));
+}
+
 #[test]
 fn test_dleq() {
     let mut rng = OsRng;
     dleq(G::random(&mut rng), Scalar::random(&mut rng));
 }
 
+#[test]
+fn test_translated_dleq() {
+    let mut rng = OsRng;
+    dleq(G::random(&mut rng), Scalar::random(&mut rng));
+}
+
 #[test]
 fn test_pedersen_commitment() {
     let mut rng = OsRng;
@@ -97,6 +109,33 @@ fn noninteractive_discrete_logarithm() {
     );
 }
 
+#[test]
+fn noninteractive_translated_discrete_logarithm() {
+    let mut rng = OsRng;
+    let (relation, witness) = translated_discrete_logarithm(Scalar::random(&mut rng));
+
+    // The SigmaProtocol induced by relation
+    let protocol = SchnorrProof::from(relation);
+    // Fiat-Shamir wrapper
+    let domain_sep = b"test-fiat-shamir-translated-schnorr";
+    let nizk = NISigmaProtocol::<SchnorrProof<G>, ShakeCodec<G>>::new(domain_sep, protocol);
+
+    // Batchable and compact proofs
+    let proof_batchable_bytes = nizk.prove_batchable(&witness, &mut rng).unwrap();
+    let proof_compact_bytes = nizk.prove_compact(&witness, &mut rng).unwrap();
+    // Verify proofs
+    let verified_batchable = nizk.verify_batchable(&proof_batchable_bytes).is_ok();
+    let verified_compact = nizk.verify_compact(&proof_compact_bytes).is_ok();
+    assert!(
+        verified_batchable,
+        "Fiat-Shamir Schnorr proof verification failed"
+    );
+    assert!(
+        verified_compact,
+        "Fiat-Shamir Schnorr proof verification failed"
+    );
+}
+
 #[test]
 fn noninteractive_dleq() {
     let mut rng = OsRng;
@@ -124,6 +163,33 @@ fn noninteractive_dleq() {
     );
 }
 
+#[test]
+fn noninteractive_translated_dleq() {
+    let mut rng = OsRng;
+    let (relation, witness) = translated_dleq(G::random(&mut rng), Scalar::random(&mut rng));
+
+    // The SigmaProtocol induced by relation
+    let protocol = SchnorrProof::from(relation);
+    // Fiat-Shamir wrapper
+    let domain_sep = b"test-fiat-shamir-translated-DLEQ";
+    let nizk = NISigmaProtocol::<SchnorrProof<G>, ShakeCodec<G>>::new(domain_sep, protocol);
+
+    // Batchable and compact proofs
+    let proof_batchable_bytes = nizk.prove_batchable(&witness, &mut rng).unwrap();
+    let proof_compact_bytes = nizk.prove_compact(&witness, &mut rng).unwrap();
+    // Verify proofs
+    let verified_batchable = nizk.verify_batchable(&proof_batchable_bytes).is_ok();
+    let verified_compact = nizk.verify_compact(&proof_compact_bytes).is_ok();
+    assert!(
+        verified_batchable,
+        "Fiat-Shamir Schnorr proof verification failed"
+    );
+    assert!(
+        verified_compact,
+        "Fiat-Shamir Schnorr proof verification failed"
+    );
+}
+
 #[test]
 fn noninteractive_pedersen_commitment() {
     let mut rng = OsRng;
diff --git a/src/tests/test_utils.rs b/src/tests/test_utils.rs
@@ -1,5 +1,6 @@
 //! Definitions used in tests for this crate.
 
+use ff::Field;
 use group::{Group, GroupEncoding};
 
 use crate::linear_relation::{msm_pr, LinearRelation};
@@ -25,6 +26,27 @@ pub fn discrete_logarithm<G: Group + GroupEncoding>(
     (relation, vec![x])
 }
 
+/// LinearMap for knowledge of a translated discrete logarithm relative to a fixed basepoint.
+#[allow(non_snake_case)]
+pub fn translated_discrete_logarithm<G: Group + GroupEncoding>(
+    x: G::Scalar,
+) -> (LinearRelation<G>, Vec<G::Scalar>) {
+    let mut relation: LinearRelation<G> = LinearRelation::new();
+
+    let var_x = relation.allocate_scalar();
+    let var_G = relation.allocate_element();
+
+    let var_X = relation.allocate_eq((var_x + <<G as Group>::Scalar as Field>::ONE) * var_G);
+
+    relation.set_element(var_G, G::generator());
+    relation.compute_image(&[x]).unwrap();
+
+    let X = relation.linear_map.group_elements.get(var_X).unwrap();
+
+    assert!(vec![X] == relation.linear_map.evaluate(&[x]).unwrap());
+    (relation, vec![x])
+}
+
 /// LinearMap for knowledge of a discrete logarithm equality between two pairs.
 #[allow(non_snake_case)]
 pub fn dleq<G: Group + GroupEncoding>(H: G, x: G::Scalar) -> (LinearRelation<G>, Vec<G::Scalar>) {
@@ -47,6 +69,31 @@ pub fn dleq<G: Group + GroupEncoding>(H: G, x: G::Scalar) -> (LinearRelation<G>,
     (relation, vec![x])
 }
 
+/// LinearMap for knowledge of a translated dleq.
+#[allow(non_snake_case)]
+pub fn translated_dleq<G: Group + GroupEncoding>(
+    H: G,
+    x: G::Scalar,
+) -> (LinearRelation<G>, Vec<G::Scalar>) {
+    let mut relation: LinearRelation<G> = LinearRelation::new();
+
+    let var_x = relation.allocate_scalar();
+    let [var_G, var_H] = relation.allocate_elements();
+
+    let var_X = relation.allocate_eq(var_x * var_G + var_H);
+    let var_Y = relation.allocate_eq(var_x * var_H + var_G);
+
+    relation.set_elements([(var_G, G::generator()), (var_H, H)]);
+    relation.compute_image(&[x]).unwrap();
+
+    let X = relation.linear_map.group_elements.get(var_X).unwrap();
+    let Y = relation.linear_map.group_elements.get(var_Y).unwrap();
+
+    assert_eq!(X, G::generator() * x + H);
+    assert_eq!(Y, H * x + G::generator());
+    (relation, vec![x])
+}
+
 /// LinearMap for knowledge of an opening to a Pederson commitment.
 #[allow(non_snake_case)]
 pub fn pedersen_commitment<G: Group + GroupEncoding>(
@@ -85,7 +132,8 @@ pub fn pedersen_commitment_dleq<G: Group + GroupEncoding>(
     let [var_x, var_r] = relation.allocate_scalars();
 
     let var_Gs = relation.allocate_elements::<4>();
-    let [var_X, var_Y] = relation.allocate_elements();
+    let var_X = relation.allocate_eq(var_x * var_Gs[0] + var_r * var_Gs[1]);
+    let var_Y = relation.allocate_eq(var_x * var_Gs[2] + var_r * var_Gs[3]);
 
     relation.set_elements([
         (var_Gs[0], generators[0]),
@@ -95,9 +143,6 @@ pub fn pedersen_commitment_dleq<G: Group + GroupEncoding>(
     ]);
     relation.set_elements([(var_X, X), (var_Y, Y)]);
 
-    relation.append_equation(var_X, [(var_x, var_Gs[0]), (var_r, var_Gs[1])]);
-    relation.append_equation(var_Y, [(var_x, var_Gs[2]), (var_r, var_Gs[3])]);
-
     assert!(vec![X, Y] == relation.linear_map.evaluate(&witness).unwrap());
     (relation, witness.to_vec())
 }
@@ -119,7 +164,12 @@ pub fn bbs_blind_commitment_computation<G: Group + GroupEncoding>(
     let [var_secret_prover_blind, var_msg_1, var_msg_2, var_msg_3] = relation.allocate_scalars();
 
     let [var_Q_2, var_J_1, var_J_2, var_J_3] = relation.allocate_elements();
-    let var_C = relation.allocate_element();
+    let var_C = relation.allocate_eq(
+        var_secret_prover_blind * var_Q_2
+            + var_msg_1 * var_J_1
+            + var_msg_2 * var_J_2
+            + var_msg_3 * var_J_3,
+    );
 
     relation.set_elements([
         (var_Q_2, Q_2),
@@ -129,16 +179,6 @@ pub fn bbs_blind_commitment_computation<G: Group + GroupEncoding>(
         (var_C, C),
     ]);
 
-    relation.append_equation(
-        var_C,
-        [
-            (var_secret_prover_blind, var_Q_2),
-            (var_msg_1, var_J_1),
-            (var_msg_2, var_J_2),
-            (var_msg_3, var_J_3),
-        ],
-    );
-
     let witness = vec![secret_prover_blind, msg_1, msg_2, msg_3];
 
     assert!(vec![C] == relation.linear_map.evaluate(&witness).unwrap());
