1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

//! Defines a TranscriptProtocol trait for using a Merlin transcript.

use curve25519_dalek::ristretto::CompressedRistretto;
use curve25519_dalek::scalar::Scalar;
use merlin::Transcript;

use errors::ProofError;

pub trait TranscriptProtocol {
/// Append a domain separator for an n-bit, m-party range proof.
fn rangeproof_domain_sep(&mut self, n: u64, m: u64);

/// Append a domain separator for a length-n inner product proof.
fn innerproduct_domain_sep(&mut self, n: u64);

/// Append a domain separator for a constraint system.
fn r1cs_domain_sep(&mut self);

/// Append a scalar with the given label.
fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar);

/// Append a point with the given label.
fn append_point(&mut self, label: &'static [u8], point: &CompressedRistretto);

/// Check that a point is not the identity, then append it to the
/// transcript.  Otherwise, return an error.
fn validate_and_append_point(
&mut self,
label: &'static [u8],
point: &CompressedRistretto,
) -> Result<(), ProofError>;

/// Compute a labeled challenge variable.
fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar;
}

impl TranscriptProtocol for Transcript {
fn rangeproof_domain_sep(&mut self, n: u64, m: u64) {
self.append_message(b"dom-sep", b"rangeproof v1");
self.append_u64(b"n", n);
self.append_u64(b"m", m);
}

fn innerproduct_domain_sep(&mut self, n: u64) {
self.append_message(b"dom-sep", b"ipp v1");
self.append_u64(b"n", n);
}

fn r1cs_domain_sep(&mut self) {
self.append_message(b"dom-sep", b"r1cs v1");
}

fn append_scalar(&mut self, label: &'static [u8], scalar: &Scalar) {
self.append_message(label, scalar.as_bytes());
}

fn append_point(&mut self, label: &'static [u8], point: &CompressedRistretto) {
self.append_message(label, point.as_bytes());
}

fn validate_and_append_point(
&mut self,
label: &'static [u8],
point: &CompressedRistretto,
) -> Result<(), ProofError> {
use curve25519_dalek::traits::IsIdentity;

if point.is_identity() {
Err(ProofError::VerificationError)
} else {
Ok(self.append_message(label, point.as_bytes()))
}
}

fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar {
let mut buf = [0u8; 64];
self.challenge_bytes(label, &mut buf);

Scalar::from_bytes_mod_order_wide(&buf)
}
}