Cleanup, last commit before Git migration
This commit is contained in:
John Doe
parent
c0f5f74a4a
commit
bebc0c7661
3 changed files with 3 additions and 3 deletions
182
blst_experiments/blindsig.c
Normal file
182
blst_experiments/blindsig.c
Normal file
|
|
@ -0,0 +1,182 @@
|
|||
// This is a (very rough) test of BLST blind signatures based on run.me from BLST's Python example code
|
||||
// Do not trust this to be secure, also this doesn't do a lot of the sanity checking yet
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include "../blst/blst.h"
|
||||
|
||||
const byte dst[] = "MY-DST";
|
||||
double time_taken;
|
||||
clock_t t;
|
||||
|
||||
byte signer_private_key[32];
|
||||
byte signer_public_key[96];
|
||||
|
||||
void printbytes(byte *toprint, int length){
|
||||
for(int i=0;i<length;i++){
|
||||
printf("%.2x ", toprint[i]);
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
void signer_key_setup(){
|
||||
blst_scalar sk;
|
||||
blst_p2 pk;
|
||||
blst_p2_affine pk_affine;
|
||||
|
||||
byte myikm[32] = {'*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*'};
|
||||
|
||||
// On signer's side:
|
||||
printf("IKM: ");
|
||||
printbytes(myikm, 32);
|
||||
|
||||
blst_keygen(&sk, myikm, 32, 0, 0);
|
||||
|
||||
blst_bendian_from_scalar(signer_private_key, &sk);
|
||||
printf("Secret Key: ");
|
||||
printbytes(signer_private_key, 32);
|
||||
|
||||
blst_sk_to_pk_in_g2(&pk, &sk);
|
||||
|
||||
blst_p2_to_affine(&pk_affine, &pk);
|
||||
|
||||
blst_p2_affine_compress(signer_public_key, &pk_affine);
|
||||
printf("Compressed Public Key (affine): ");
|
||||
printbytes(signer_public_key, 96);
|
||||
}
|
||||
|
||||
void signer(byte *compressed_signature, byte *msg_for_wire){
|
||||
blst_scalar sk;
|
||||
blst_p1 msg, signature;
|
||||
blst_p1_affine msg_affine;
|
||||
byte debug_print_buf[256];
|
||||
|
||||
// get the secret key as a scalar
|
||||
blst_scalar_from_bendian(&sk, signer_private_key);
|
||||
|
||||
// Deserialize the message - it's already a serialized P1 point, we don't need to (literally) rehash it
|
||||
blst_p1_uncompress(&msg_affine, msg_for_wire);
|
||||
|
||||
// i do not know why deserializing always gives you affine points
|
||||
blst_p1_from_affine(&msg, &msg_affine);
|
||||
|
||||
// Confirm the message point is in the G1 group
|
||||
assert(blst_p1_in_g1(&msg));
|
||||
|
||||
// sign with it
|
||||
blst_sign_pk_in_g2(&signature, &msg, &sk);
|
||||
|
||||
// Serialize and print the signature
|
||||
blst_p1_serialize(debug_print_buf, &signature);
|
||||
printf("Signature: ");
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Compress and print the signature
|
||||
blst_p1_compress(compressed_signature, &signature);
|
||||
printf("Compressed Signature: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
}
|
||||
|
||||
void verifier(byte *compressed_signature, byte *msg){
|
||||
blst_p1_affine sig;
|
||||
blst_p2_affine pk;
|
||||
|
||||
blst_p1_uncompress(&sig, compressed_signature);
|
||||
blst_p2_uncompress(&pk, signer_public_key);
|
||||
|
||||
BLST_ERROR returned;
|
||||
|
||||
// TODO: check if in g2 group
|
||||
|
||||
returned = blst_core_verify_pk_in_g2(&pk, &sig, 1, msg, strlen((char *) msg), dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
if(returned == BLST_SUCCESS){
|
||||
printf("Verified!\n");
|
||||
}else{
|
||||
printf("Not verified!\n");
|
||||
}
|
||||
}
|
||||
|
||||
// main is the "user" in this test
|
||||
int main(){
|
||||
byte debug_print_buf[256];
|
||||
byte compressed_blinded_signature[48];
|
||||
byte compressed_signature[48];
|
||||
byte msg[] = "assertion";
|
||||
byte blinding_r_bytes[32] = {'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R'};
|
||||
blst_scalar blinding_r, inverse_blinding_r;
|
||||
blst_p1 hash, msg_for_wire;
|
||||
byte msg_for_wire_bytes[96];
|
||||
blst_p1_affine returned_signature_affine;
|
||||
blst_p1 returned_signature, unblinded_signature;
|
||||
|
||||
printf("msg is now %s\n", msg);
|
||||
|
||||
// Set up the signer's keys first so that we can know its public key
|
||||
signer_key_setup();
|
||||
|
||||
// Get a hash of the message - we put the signer's public key in aug here, I don't know why
|
||||
blst_hash_to_g1(&hash, msg, strlen((char *) msg), dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
printf("HASH: ");
|
||||
blst_p1_serialize(debug_print_buf, &hash);
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Get a BLST scalar of your "random" (LOL) blinding factor r
|
||||
blst_scalar_from_bendian(&blinding_r, blinding_r_bytes);
|
||||
|
||||
printf("R BYTES: ");
|
||||
printbytes(blinding_r_bytes, 32);
|
||||
|
||||
// Blind the message by signing it with the blinding factor R as if it was a secret key
|
||||
blst_sign_pk_in_g2(&msg_for_wire, &hash, &blinding_r);
|
||||
|
||||
// Serialize the blinded message to send it over the wire
|
||||
blst_p1_compress(msg_for_wire_bytes, &msg_for_wire);
|
||||
|
||||
printf("Blinded and compressed for wire: ");
|
||||
printbytes(msg_for_wire_bytes, 48);
|
||||
|
||||
// Send the message off to be signed and get the results back
|
||||
signer(compressed_blinded_signature, msg_for_wire_bytes);
|
||||
|
||||
printf("COMPRESSED BLINDED SIG: ");
|
||||
printbytes(compressed_blinded_signature, 48);
|
||||
|
||||
// We now have the signature back. returned_signature is a blst_p1_affine because this is pk_in_g2.
|
||||
blst_p1_uncompress(&returned_signature_affine, compressed_blinded_signature);
|
||||
|
||||
// Convert the uncompressed returned signature from an affine to a P1
|
||||
blst_p1_from_affine(&returned_signature, &returned_signature_affine);
|
||||
|
||||
// Confirm the signature point is in the G1 group
|
||||
assert(blst_p1_in_g1(&returned_signature));
|
||||
|
||||
printf("RETURNED SIGNATURE: ");
|
||||
blst_p1_serialize(debug_print_buf, &returned_signature);
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Get the inverse of R. We'll need this to unblind the signature.
|
||||
blst_sk_inverse(&inverse_blinding_r, &blinding_r);
|
||||
|
||||
// Print the inverse of R
|
||||
printf("INVERSE R: ");
|
||||
blst_bendian_from_scalar(debug_print_buf, &inverse_blinding_r);
|
||||
printbytes(debug_print_buf, 32);
|
||||
|
||||
// Sign the blinded signature we get back from the signer with the inverse of the blinding factor
|
||||
blst_sign_pk_in_g2(&unblinded_signature, &returned_signature, &inverse_blinding_r);
|
||||
|
||||
blst_p1_compress(compressed_signature, &unblinded_signature);
|
||||
|
||||
printf("UNBLINDED SIGNATURE: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
|
||||
//msg[8] = 'A';
|
||||
|
||||
printf("msg is now %s\n", msg);
|
||||
|
||||
// Now on verifier's side (after compressed_signature, serialized_public_key, and msg are passed over the network)
|
||||
verifier(compressed_signature, msg);
|
||||
}
|
||||
188
blst_experiments/blindsig2.c
Normal file
188
blst_experiments/blindsig2.c
Normal file
|
|
@ -0,0 +1,188 @@
|
|||
// This is a (very rough) test of BLST blind signatures based on run.me from BLST's Python example code
|
||||
// Do not trust this to be secure, also this doesn't do a lot of the sanity checking yet
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include <assert.h>
|
||||
#include "../blst/blst.h"
|
||||
|
||||
const byte dst[] = "MY-DST";
|
||||
double time_taken;
|
||||
clock_t t;
|
||||
|
||||
byte signer_private_key[32];
|
||||
byte signer_public_key[96];
|
||||
|
||||
void printbytes(byte *toprint, int length){
|
||||
for(int i=0;i<length;i++){
|
||||
printf("%.2x ", toprint[i]);
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
void signer_key_setup(){
|
||||
blst_scalar sk;
|
||||
blst_p2 pk;
|
||||
blst_p2_affine pk_affine;
|
||||
|
||||
byte myikm[32] = {'*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*'};
|
||||
|
||||
// On signer's side:
|
||||
printf("IKM: ");
|
||||
printbytes(myikm, 32);
|
||||
|
||||
blst_keygen(&sk, myikm, 32, 0, 0);
|
||||
|
||||
blst_bendian_from_scalar(signer_private_key, &sk);
|
||||
printf("Secret Key: ");
|
||||
printbytes(signer_private_key, 32);
|
||||
|
||||
blst_sk_to_pk_in_g2(&pk, &sk);
|
||||
|
||||
blst_p2_to_affine(&pk_affine, &pk);
|
||||
|
||||
blst_p2_affine_compress(signer_public_key, &pk_affine);
|
||||
printf("Compressed Public Key (affine): ");
|
||||
printbytes(signer_public_key, 96);
|
||||
}
|
||||
|
||||
void signer(byte *compressed_signature, byte *msg_for_wire){
|
||||
blst_scalar sk;
|
||||
blst_p1 msg, signature;
|
||||
blst_p1_affine msg_affine;
|
||||
byte debug_print_buf[256];
|
||||
|
||||
// get the secret key as a scalar
|
||||
blst_scalar_from_bendian(&sk, signer_private_key);
|
||||
|
||||
// Deserialize the message - it's already a serialized P1 point, we don't need to (literally) rehash it
|
||||
blst_p1_uncompress(&msg_affine, msg_for_wire);
|
||||
|
||||
// i do not know why deserializing always gives you affine points
|
||||
blst_p1_from_affine(&msg, &msg_affine);
|
||||
|
||||
// Confirm the message point is in the G1 group
|
||||
assert(blst_p1_in_g1(&msg));
|
||||
|
||||
// sign with it
|
||||
blst_sign_pk_in_g2(&signature, &msg, &sk);
|
||||
|
||||
// Serialize and print the signature
|
||||
blst_p1_serialize(debug_print_buf, &signature);
|
||||
printf("Signature: ");
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Compress and print the signature
|
||||
blst_p1_compress(compressed_signature, &signature);
|
||||
printf("Compressed Signature: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
}
|
||||
|
||||
void verifier(byte *compressed_signature, byte *msg){
|
||||
blst_p1_affine sig;
|
||||
blst_p2_affine pk;
|
||||
|
||||
blst_p1_uncompress(&sig, compressed_signature);
|
||||
blst_p2_uncompress(&pk, signer_public_key);
|
||||
|
||||
BLST_ERROR returned;
|
||||
|
||||
// TODO: check if in g2 group
|
||||
|
||||
returned = blst_core_verify_pk_in_g2(&pk, &sig, 1, msg, 16, dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
if(returned == BLST_SUCCESS){
|
||||
printf("Verified!\n");
|
||||
}else{
|
||||
printf("Not verified!\n");
|
||||
}
|
||||
}
|
||||
|
||||
// main is the "user" in this test
|
||||
int main(){
|
||||
byte debug_print_buf[256];
|
||||
byte compressed_blinded_signature[48];
|
||||
byte compressed_signature[48];
|
||||
byte msg[16] = {'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A', 'A'};
|
||||
byte blinding_r_bytes[32] = {'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R', 'R'};
|
||||
blst_scalar blinding_r, inverse_blinding_r;
|
||||
blst_p1 hash, msg_for_wire;
|
||||
byte msg_for_wire_bytes[96];
|
||||
blst_p1_affine returned_signature_affine;
|
||||
blst_p1 returned_signature, unblinded_signature;
|
||||
|
||||
printf("msg is now ", msg);
|
||||
printbytes(msg, 16);
|
||||
printf("\n");
|
||||
|
||||
// Set up the signer's keys first so that we can know its public key
|
||||
signer_key_setup();
|
||||
|
||||
// Get a hash of the message - we put the signer's public key in aug here, I don't know why
|
||||
blst_hash_to_g1(&hash, msg, 16, dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
printf("HASH: ");
|
||||
blst_p1_serialize(debug_print_buf, &hash);
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Get a BLST scalar of your "random" (LOL) blinding factor r
|
||||
blst_scalar_from_bendian(&blinding_r, blinding_r_bytes);
|
||||
|
||||
printf("R BYTES: ");
|
||||
printbytes(blinding_r_bytes, 32);
|
||||
|
||||
// Blind the message by signing it with the blinding factor R as if it was a secret key
|
||||
blst_sign_pk_in_g2(&msg_for_wire, &hash, &blinding_r);
|
||||
|
||||
// Serialize the blinded message to send it over the wire
|
||||
blst_p1_compress(msg_for_wire_bytes, &msg_for_wire);
|
||||
|
||||
printf("Blinded and compressed for wire: ");
|
||||
printbytes(msg_for_wire_bytes, 48);
|
||||
|
||||
// Send the message off to be signed and get the results back
|
||||
signer(compressed_blinded_signature, msg_for_wire_bytes);
|
||||
|
||||
printf("COMPRESSED BLINDED SIG: ");
|
||||
printbytes(compressed_blinded_signature, 48);
|
||||
|
||||
// We now have the signature back. returned_signature is a blst_p1_affine because this is pk_in_g2.
|
||||
blst_p1_uncompress(&returned_signature_affine, compressed_blinded_signature);
|
||||
|
||||
// Convert the uncompressed returned signature from an affine to a P1
|
||||
blst_p1_from_affine(&returned_signature, &returned_signature_affine);
|
||||
|
||||
// Confirm the signature point is in the G1 group
|
||||
assert(blst_p1_in_g1(&returned_signature));
|
||||
|
||||
printf("RETURNED SIGNATURE: ");
|
||||
blst_p1_serialize(debug_print_buf, &returned_signature);
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Get the inverse of R. We'll need this to unblind the signature.
|
||||
blst_sk_inverse(&inverse_blinding_r, &blinding_r);
|
||||
|
||||
// Print the inverse of R
|
||||
printf("INVERSE R: ");
|
||||
blst_bendian_from_scalar(debug_print_buf, &inverse_blinding_r);
|
||||
printbytes(debug_print_buf, 32);
|
||||
|
||||
// Sign the blinded signature we get back from the signer with the inverse of the blinding factor
|
||||
blst_sign_pk_in_g2(&unblinded_signature, &returned_signature, &inverse_blinding_r);
|
||||
|
||||
blst_p1_compress(compressed_signature, &unblinded_signature);
|
||||
|
||||
printf("UNBLINDED SIGNATURE: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
|
||||
// uncomment to change the message and have the signature fail the check
|
||||
//msg[8] = ' ';
|
||||
|
||||
printf("msg is now ", msg);
|
||||
printbytes(msg, 16);
|
||||
printf("\n");
|
||||
|
||||
// Now on verifier's side (after compressed_signature, serialized_public_key, and msg are passed over the network)
|
||||
verifier(compressed_signature, msg);
|
||||
}
|
||||
131
blst_experiments/nonblind.c
Normal file
131
blst_experiments/nonblind.c
Normal file
|
|
@ -0,0 +1,131 @@
|
|||
// This is a (very rough) test of BLST blind signatures based on run.me from BLST's Python example code
|
||||
// Do not trust this to be secure, also this doesn't do a lot of the sanity checking yet
|
||||
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <time.h>
|
||||
#include "../blst/blst.h"
|
||||
|
||||
const byte dst[] = "MY-DST";
|
||||
double time_taken;
|
||||
clock_t t;
|
||||
|
||||
byte signer_private_key[32];
|
||||
byte signer_public_key[96];
|
||||
|
||||
void printbytes(byte *toprint, int length){
|
||||
for(int i=0;i<length;i++){
|
||||
printf("%.2x ", toprint[i]);
|
||||
}
|
||||
printf("\n");
|
||||
}
|
||||
|
||||
void signer_key_setup(){
|
||||
blst_scalar sk;
|
||||
blst_p2 pk;
|
||||
blst_p2_affine pk_affine;
|
||||
|
||||
byte myikm[32] = {'*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*', '*'};
|
||||
|
||||
// On signer's side:
|
||||
printf("IKM: ");
|
||||
printbytes(myikm, 32);
|
||||
|
||||
blst_keygen(&sk, myikm, 32, 0, 0);
|
||||
|
||||
blst_bendian_from_scalar(signer_private_key, &sk);
|
||||
printf("Secret Key: ");
|
||||
printbytes(signer_private_key, 32);
|
||||
|
||||
blst_sk_to_pk_in_g2(&pk, &sk);
|
||||
|
||||
blst_p2_to_affine(&pk_affine, &pk);
|
||||
|
||||
blst_p2_affine_compress(signer_public_key, &pk_affine);
|
||||
printf("Compressed Public Key (affine): ");
|
||||
printbytes(signer_public_key, 96);
|
||||
}
|
||||
|
||||
void signer(byte *compressed_signature, byte *msg_for_wire){
|
||||
blst_scalar sk;
|
||||
blst_p1 msg, signature;
|
||||
blst_p1_affine msg_affine;
|
||||
byte debug_print_buf[256];
|
||||
|
||||
// get the secret key as a scalar
|
||||
blst_scalar_from_bendian(&sk, signer_private_key);
|
||||
|
||||
// Deserialize the message - it's already a serialized P1 point, we don't need to (literally) rehash it
|
||||
blst_p1_deserialize(&msg_affine, msg_for_wire);
|
||||
|
||||
// i do not know why deserializing always gives you affine points
|
||||
blst_p1_from_affine(&msg, &msg_affine);
|
||||
|
||||
// sign with it
|
||||
blst_sign_pk_in_g2(&signature, &msg, &sk);
|
||||
|
||||
// Serialize and print the signature
|
||||
blst_p1_serialize(debug_print_buf, &signature);
|
||||
printf("Signature: ");
|
||||
printbytes(debug_print_buf, 96);
|
||||
|
||||
// Compress and print the signature
|
||||
blst_p1_compress(compressed_signature, &signature);
|
||||
printf("Compressed Signature: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
}
|
||||
|
||||
void verifier(byte *compressed_signature, byte *msg){
|
||||
blst_p1_affine sig;
|
||||
blst_p2_affine pk;
|
||||
|
||||
blst_p1_uncompress(&sig, compressed_signature);
|
||||
blst_p2_uncompress(&pk, signer_public_key);
|
||||
|
||||
BLST_ERROR returned;
|
||||
|
||||
// TODO: check if in g2 group
|
||||
|
||||
returned = blst_core_verify_pk_in_g2(&pk, &sig, 1, msg, strlen((char *) msg), dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
if(returned == BLST_SUCCESS){
|
||||
printf("Verified!\n");
|
||||
}else{
|
||||
printf("Not verified!\n");
|
||||
}
|
||||
}
|
||||
|
||||
// main is the "user" in this test
|
||||
int main(){
|
||||
byte compressed_signature[48];
|
||||
byte msg[] = "assertion";
|
||||
blst_p1 hash;
|
||||
byte msg_for_wire_bytes[96];
|
||||
|
||||
printf("msg is now %s\n", msg);
|
||||
|
||||
// Set up the signer's keys first so that we can know its public key
|
||||
signer_key_setup();
|
||||
|
||||
// Get a hash of the message - we put the signer's public key in aug here, I don't know why
|
||||
blst_hash_to_g1(&hash, msg, strlen((char *) msg), dst, strlen((char *) dst), signer_public_key, 96);
|
||||
|
||||
// Serialize the blinded message to send it over the wire
|
||||
blst_p1_serialize(msg_for_wire_bytes, &hash);
|
||||
|
||||
printf("Hashed for wire: ");
|
||||
printbytes(msg_for_wire_bytes, 96);
|
||||
|
||||
// Send the message off to be signed and get the results back
|
||||
signer(compressed_signature, msg_for_wire_bytes);
|
||||
|
||||
printf("RETURNED SIGNATURE: ");
|
||||
printbytes(compressed_signature, 48);
|
||||
|
||||
//msg[8] = 'A';
|
||||
|
||||
printf("msg is now %s\n", msg);
|
||||
|
||||
// Now on verifier's side (after compressed_signature, serialized_public_key, and msg are passed over the network)
|
||||
verifier(compressed_signature, msg);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue