public void GetElementIntTest() { FieldZq Zq = FieldZq.CreateFieldZq(new byte[] { 0x05 }); Assert.AreEqual <FieldZqElement>(Zq.GetElement(0), Zq.GetElement(-0), "-0"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(1).Negate(), Zq.GetElement(-1), "-1"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(2).Negate(), Zq.GetElement(-2), "-2"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(3).Negate(), Zq.GetElement(-3), "-3"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(4).Negate(), Zq.GetElement(-4), "-4"); ParameterSet parameters = ECParameterSets.ParamSet_EC_P256_V1; Assert.AreEqual <FieldZqElement>(parameters.Group.FieldZq.GetElement(456).Negate(), parameters.Group.FieldZq.GetElement(-456), "-456"); Assert.AreEqual <FieldZqElement>(parameters.Group.FieldZq.GetElement(1).Negate(), parameters.Group.FieldZq.GetElement(-1), "-1"); Assert.AreEqual <FieldZqElement>(parameters.Group.FieldZq.GetElement(10000034).Negate(), parameters.Group.FieldZq.GetElement(-10000034), "-10000034"); }
/// <summary> /// Takes as input a series of commitments to 0 and 1, and composes them into a single Pedersen commitment: /// output.CommittedValue = product (2^i * committedBits[i].CommittedValue) /// </summary> /// <param name="committedBits">Array of commitments to Zero and One. Each commitment must use the same bases G and H.</param> /// <param name="fieldZq">Field corresponding to all PedersenCommitments</param> /// <param name="composition">Output paramter.</param> /// <returns>True on success, false on failure.</returns> private static bool ComposeCommitments(PedersenCommitment[] committedBits, FieldZq fieldZq, out PedersenCommitment composition) { try { FieldZqElement two = fieldZq.GetElement(2); FieldZqElement powerOfTwo = fieldZq.One; DLRepOfGroupElement[] bitsExpPowerOfTwo = new DLRepOfGroupElement[committedBits.Length]; for (int i = 0; i < committedBits.Length; ++i) { bitsExpPowerOfTwo[i] = committedBits[i].Exponentiate(powerOfTwo); powerOfTwo = powerOfTwo * two; } DLRepOfGroupElement actualComposition; bool success = DLRepOfGroupElement.TryStrictMultiply(bitsExpPowerOfTwo, out actualComposition); if (success) { composition = new PedersenCommitment(actualComposition); return(true); } } catch (Exception) { // do nothing } composition = null; return(false); }
public void NegateTest() { FieldZq Zq = FieldZq.CreateFieldZq(new byte[] { 0x05 }); Assert.AreEqual <FieldZqElement>(Zq.Zero.Negate(), Zq.Zero); Assert.AreEqual <FieldZqElement>(Zq.GetElement(1).Negate(), Zq.GetElement(4)); Assert.AreEqual <FieldZqElement>(Zq.GetElement(2).Negate(), Zq.GetElement(3)); Assert.AreEqual <FieldZqElement>(Zq.GetElement(3).Negate(), Zq.GetElement(2)); Assert.AreEqual <FieldZqElement>(Zq.GetElement(4).Negate(), Zq.GetElement(1)); }
/// <summary> /// Convert a base64 string to a FieldElement. /// </summary> /// <param name="encodedString">The encoded string to convert.</param> /// <param name="Zq">The FieldZq object to which the encoded element belongs.</param> /// <returns>The converted object.</returns> public static FieldZqElement ToFieldZqElement(this String encodedString, FieldZq Zq) { if (encodedString == null) { return(null); } if (Zq == null) { throw new ArgumentNullException("Zq"); } return(Zq.GetElement(Convert.FromBase64String(encodedString))); }
public void SubtractTest() { FieldZq Zq = FieldZq.CreateFieldZq(new byte[] { 0x05 }); FieldZqElement two = Zq.GetElement(2); FieldZqElement three = Zq.GetElement(3); FieldZqElement four = Zq.GetElement(4); Assert.AreEqual <FieldZqElement>(four, four - Zq.Zero, "4-0=4"); Assert.AreEqual <FieldZqElement>(three, four - Zq.One, "4-1=3"); Assert.AreEqual <FieldZqElement>(two, four - two, "4-2=2"); Assert.AreEqual <FieldZqElement>(Zq.One, four - three, "4-3=1"); Assert.AreEqual <FieldZqElement>(Zq.Zero, four - four, "4-4=0"); Assert.AreEqual <FieldZqElement>(three, two - four, "2-4=3"); Assert.AreEqual <FieldZqElement>(four, two - three, "2-3=4"); Assert.AreEqual <FieldZqElement>(two, two.Subtract(Zq.Zero), "2-0=2"); Assert.AreEqual <FieldZqElement>(Zq.One, two.Subtract(Zq.One), "2-1=1"); Assert.AreEqual <FieldZqElement>(Zq.Zero, two.Subtract(two), "2-2=0"); Assert.AreEqual <FieldZqElement>(four, two.Subtract(three), "2-3=4"); Assert.AreEqual <FieldZqElement>(three, two.Subtract(four), "2-4=3"); }
public void DivideTest() { ParameterSet parameters = ECParameterSets.ParamSet_EC_P256_V1; for (int i = 0; i < 10; ++i) { FieldZqElement a = parameters.Group.FieldZq.GetRandomElement(false); FieldZqElement b = parameters.Group.FieldZq.GetRandomElement(true); FieldZqElement c = a.Divide(b); Assert.AreEqual <FieldZqElement>(a * b.Invert(), c, "a.divide(b)."); FieldZqElement d = a / b; Assert.AreEqual <FieldZqElement>(c, d, "a / b"); } FieldZq Zq = FieldZq.CreateFieldZq(new byte[] { 0x05 }); Assert.AreEqual <FieldZqElement>(Zq.GetElement(4), Zq.GetElement(2) / Zq.GetElement(3), "2/3 = 4"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(4), Zq.GetElement(1) / Zq.GetElement(4), "1/4 = 4"); Assert.AreEqual <FieldZqElement>(Zq.GetElement(1), Zq.GetElement(2) / Zq.GetElement(2), "2/3 = 1"); }
public void EncodingTest() { // a large value byte[] modulus = new byte[] { 0xef, 0x09, 0x90, 0x06, 0x1d, 0xb6, 0x7a, 0x9e, 0xae, 0xba, 0x26, 0x5f, 0x1b, 0x8f, 0xa1, 0x2b, 0x55, 0x33, 0x90, 0xa8, 0x17, 0x5b, 0xcb, 0x3d, 0x0c, 0x2e, 0x5e, 0xe5, 0xdf, 0xb8, 0x26, 0xe2, 0x29, 0xad, 0x37, 0x43, 0x11, 0x48, 0xce, 0x31, 0xf8, 0xb0, 0xe5, 0x31, 0x77, 0x7f, 0x19, 0xc1, 0xe3, 0x81, 0xc6, 0x23, 0xe6, 0x00, 0xbf, 0xf7, 0xc5, 0x5a, 0x23, 0xa8, 0xe6, 0x49, 0xcc, 0xbc, 0xf8, 0x33, 0xf2, 0xdb, 0xa9, 0x9e, 0x6a, 0xd6, 0x6e, 0x52, 0x37, 0x8e, 0x92, 0xf7, 0x49, 0x2b, 0x24, 0xff, 0x8c, 0x1e, 0x6f, 0xb1, 0x89, 0xfa, 0x84, 0x34, 0xf5, 0x40, 0x2f, 0xe4, 0x15, 0x24, 0x9a, 0xe0, 0x2b, 0xf9, 0x2b, 0x3e, 0xd8, 0xea, 0xaa, 0xa2, 0x20, 0x2e, 0xc3, 0x41, 0x7b, 0x20, 0x79, 0xda, 0x4f, 0x35, 0xe9, 0x85, 0xbb, 0x42, 0xa4, 0x21, 0xcf, 0xab, 0xa8, 0x16, 0x0b, 0x66, 0x94, 0x99, 0x83, 0x38, 0x4e, 0x56, 0x36, 0x5a, 0x44, 0x86, 0xc0, 0x46, 0x22, 0x9f, 0xc8, 0xc8, 0x18, 0xf9, 0x30, 0xb8, 0x0a, 0x60, 0xd6, 0xc2, 0xc2, 0xe2, 0x0c, 0x5d, 0xf8, 0x80, 0x53, 0x4d, 0x42, 0x40, 0xd0, 0xd8, 0x1e, 0x9a, 0x37, 0x0e, 0xef, 0x67, 0x6a, 0x1c, 0x3b, 0x0e, 0xd1, 0xd8, 0xff, 0x30, 0x34, 0x0a, 0x96, 0xb2, 0x1b, 0x89, 0xf6, 0x9c, 0x54, 0xce, 0xb8, 0xf3, 0xdf, 0x17, 0xe3, 0x1b, 0xc2, 0x0c, 0x5b, 0x60, 0x1e, 0x99, 0x44, 0x45, 0xa1, 0xd3, 0x47, 0xa4, 0x5d, 0x95, 0xf4, 0x1a, 0xe0, 0x71, 0x76, 0xc7, 0x38, 0x0c, 0x60, 0xdb, 0x2a, 0xce, 0xdd, 0xee, 0xda, 0x5c, 0x59, 0x80, 0x96, 0x43, 0x62, 0xe3, 0xa8, 0xdd, 0x3f, 0x97, 0x3d, 0x6d, 0x4b, 0x24, 0x1b, 0xcf, 0x91, 0x0c, 0x7f, 0x7a, 0x02, 0xed, 0x3b, 0x60, 0x38, 0x3a, 0x01, 0x02, 0xd8, 0x06, 0x0c, 0x27 }; FieldZq field = FieldZq.CreateFieldZq(modulus); for (int i = 0; i < 20; i++) { FieldZqElement r = field.GetRandomElement(false); FieldZqElement r2 = field.GetElement(r.ToByteArray()); Assert.AreEqual <FieldZqElement>(r, r2); } }
public void InverseTest() { FieldZq Zq = FieldZq.CreateFieldZq(new byte[] { 0x05 }); try { FieldZqElement inverse = Zq.Zero.Invert(); Assert.Fail(); } catch (ArgumentOutOfRangeException) { }; Assert.AreEqual <FieldZqElement>(Zq.One.Invert(), Zq.One); Assert.AreEqual <FieldZqElement>(Zq.GetElement(2).Invert(), Zq.GetElement(3)); Assert.AreEqual <FieldZqElement>(Zq.GetElement(3).Invert(), Zq.GetElement(2)); Assert.AreEqual <FieldZqElement>(Zq.GetElement(4).Invert(), Zq.GetElement(4)); }
public void BDDecompositionTest() { FieldZqElement zero; FieldZqElement one; FieldZqElement two; FieldZqElement five; FieldZqElement ten; BitArray dec; FieldZqElement recompose; for (int paramIndex = 0; paramIndex < _parameters.Length; ++paramIndex) { FieldZq field = _parameters[paramIndex].FieldZq; zero = field.Zero; one = field.One; two = field.GetElement(2); five = field.GetElement(5); ten = field.GetElement(10); dec = VerifierBitDecompositionParameters.GetBitDecomposition(one, 10, field); recompose = VerifierBitDecompositionParameters.GetBitComposition(dec, field); Assert.AreEqual(one, recompose); Assert.AreEqual(true, dec.Get(0), "first bit should be one"); Assert.AreEqual(false, dec.Get(1), "second bit should be zero"); Assert.AreEqual(10, dec.Length, "decomposition length should be 10"); dec = VerifierBitDecompositionParameters.GetBitDecomposition(two, 20, field); recompose = VerifierBitDecompositionParameters.GetBitComposition(dec, field); Assert.AreEqual(20, dec.Length, "decomposition length should be 10"); Assert.AreEqual(two, recompose); Assert.AreEqual(false, dec[0], "first bit is 0"); Assert.AreEqual(true, dec[1], "second bit is 1"); Assert.AreEqual(false, dec[2], "third bit is 0"); Assert.AreEqual(false, dec[19], "last bit is 0"); dec = VerifierBitDecompositionParameters.GetBitDecomposition(five, 30, field); recompose = VerifierBitDecompositionParameters.GetBitComposition(dec, field); Assert.AreEqual(30, dec.Length, "decomposition length should be 30"); Assert.AreEqual(five, recompose); Assert.AreEqual(true, dec[0], "first bit is 1"); Assert.AreEqual(false, dec[1], "second bit is 0"); Assert.AreEqual(true, dec[2], "third bit is 1"); Assert.AreEqual(false, dec[3], "fourth bit is 0"); Assert.AreEqual(false, dec[4], "fifth bit is 0"); Assert.AreEqual(false, dec[29], "last bit is 0"); dec = VerifierBitDecompositionParameters.GetBitDecomposition(ten, 30, field); recompose = VerifierBitDecompositionParameters.GetBitComposition(dec, field); Assert.AreEqual(30, dec.Length, "decomposition length should be 30"); Assert.AreEqual(ten, recompose); Assert.AreEqual(false, dec[0], "first bit is 0"); Assert.AreEqual(true, dec[1], "second bit is 1"); Assert.AreEqual(false, dec[2], "third bit is 0"); Assert.AreEqual(true, dec[3], "fourth bit is 1"); Assert.AreEqual(false, dec[4], "fifth bit is 0"); Assert.AreEqual(false, dec[29], "last bit is 0"); FieldZqElement random = field.GetRandomElement(true); dec = VerifierBitDecompositionParameters.GetBitDecomposition(random, 0, field); recompose = VerifierBitDecompositionParameters.GetBitComposition(dec, field); Assert.AreEqual(random, recompose, "recomposition failed"); } }
public void ProtocolTest() { Stopwatch sw = new Stopwatch(); sw.Start(); bool[] bools = new bool[] { true, false }; foreach (bool isSubgroupConstruction in bools) { foreach (bool supportDevice in bools) { foreach (int DSize in new int[] { 0, 2, 5 }) { foreach (bool isLite in bools) { string filename = "TestVectorData\\testvectors_"; if (isSubgroupConstruction) { filename += "SG"; } else { filename += "EC"; } if (supportDevice) { filename += "_Device"; } filename += ("_D" + DSize); if (isLite) { filename += "_lite"; } filename += "_doc.txt"; var vectors = GetTestVectors(filename); IssuerKeyAndParameters ikap = LoadIssuerKeyAndParameters(isSubgroupConstruction, vectors["GroupName"], supportDevice, vectors); FieldZq Zq = ikap.IssuerParameters.Zq; // replace random y0/g0 with test vector values ikap.PrivateKey = Zq.GetElement(HexToBytes(vectors["y0"])); ikap.IssuerParameters.G[0] = CreateGroupElement(ikap.IssuerParameters.Gq, vectors["g0"]); Assert.AreEqual(ikap.IssuerParameters.G[0], ikap.IssuerParameters.Gq.G.Exponentiate(ikap.PrivateKey), "g0 computation"); IssuerParameters ip = ikap.IssuerParameters; ip.Verify(); /* * issuance */ byte[][] A = new byte[][] { HexToBytes(vectors["A1"]), HexToBytes(vectors["A2"]), HexToBytes(vectors["A3"]), HexToBytes(vectors["A4"]), HexToBytes(vectors["A5"]) }; Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x1"])), ProtocolHelper.ComputeXi(ip, 0, A[0]), "x1"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x2"])), ProtocolHelper.ComputeXi(ip, 1, A[1]), "x2"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x3"])), ProtocolHelper.ComputeXi(ip, 2, A[2]), "x3"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x4"])), ProtocolHelper.ComputeXi(ip, 3, A[3]), "x4"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x5"])), ProtocolHelper.ComputeXi(ip, 4, A[4]), "x5"); byte[] TI = HexToBytes(vectors["TI"]); Assert.IsTrue(HexToBytes(vectors["P"]).SequenceEqual(ip.Digest(supportDevice)), "P"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["xt"])), ProtocolHelper.ComputeXt(ip, TI, supportDevice), "xt"); IDevice device = null; GroupElement hd = null; if (supportDevice) { device = new VirtualDevice(ip, Zq.GetElement(HexToBytes(vectors["xd"])), Zq.GetElement(HexToBytes(vectors["wdPrime"]))); IDevicePresentationContext context = device.GetPresentationContext(); // Test device responses Assert.AreEqual(CreateGroupElement(ip.Gq, vectors["hd"]), device.GetDevicePublicKey(), "hd"); Assert.AreEqual(CreateGroupElement(ip.Gq, vectors["ad"]), context.GetInitialWitness(), "ad"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["rdPrime"])), context.GetDeviceResponse(HexToBytes(vectors["md"]), HexToBytes(vectors["cp"]), ip.HashFunctionOID), "rdPrime"); hd = CreateGroupElement(ip.Gq, vectors["hd"]); } IssuerProtocolParameters ipp = new IssuerProtocolParameters(ikap); ipp.Attributes = A; ipp.NumberOfTokens = 1; ipp.TokenInformation = TI; ipp.DevicePublicKey = hd; ipp.PreGeneratedW = new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["w"])) }; Issuer issuer = ipp.CreateIssuer(); byte[] PI = HexToBytes(vectors["PI"]); ProverProtocolParameters ppp = new ProverProtocolParameters(ip); ppp.Attributes = A; ppp.NumberOfTokens = 1; ppp.TokenInformation = TI; ppp.ProverInformation = PI; ppp.DevicePublicKey = hd; ppp.ProverRandomData = new ProverRandomData( new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["alpha"])) }, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["beta1"])) }, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["beta2"])) }); Prover prover = ppp.CreateProver(); FirstIssuanceMessage msg1 = issuer.GenerateFirstMessage(); Assert.AreEqual(msg1.sigmaZ, CreateGroupElement(ip.Gq, vectors["sigmaZ"]), "sigmaZ"); Assert.AreEqual(msg1.sigmaA[0], CreateGroupElement(ip.Gq, vectors["sigmaA"]), "sigmaA"); Assert.AreEqual(msg1.sigmaB[0], CreateGroupElement(ip.Gq, vectors["sigmaB"]), "sigmaB"); SecondIssuanceMessage msg2 = prover.GenerateSecondMessage(msg1); Assert.AreEqual(msg2.sigmaC[0], Zq.GetElement(HexToBytes(vectors["sigmaC"])), "sigmaC"); ThirdIssuanceMessage msg3 = issuer.GenerateThirdMessage(msg2); Assert.AreEqual(msg3.sigmaR[0], Zq.GetElement(HexToBytes(vectors["sigmaR"])), "sigmaR"); UProveKeyAndToken[] upkt = prover.GenerateTokens(msg3); Assert.AreEqual(upkt[0].PrivateKey, Zq.GetElement(HexToBytes(vectors["alphaInverse"])), "alphaInverse"); UProveToken token = upkt[0].Token; Assert.AreEqual(token.H, CreateGroupElement(ip.Gq, vectors["h"]), "h"); Assert.AreEqual(token.SigmaZPrime, CreateGroupElement(ip.Gq, vectors["sigmaZPrime"]), "sigmaZPrime"); Assert.AreEqual(token.SigmaCPrime, Zq.GetElement(HexToBytes(vectors["sigmaCPrime"])), "sigmaCPrime"); Assert.AreEqual(token.SigmaRPrime, Zq.GetElement(HexToBytes(vectors["sigmaRPrime"])), "sigmaRPrime"); Assert.IsTrue(HexToBytes(vectors["UIDt"]).SequenceEqual(ProtocolHelper.ComputeTokenID(ip, token)), "UIDt"); Assert.IsTrue(supportDevice == token.IsDeviceProtected); /* * presentation */ int[] disclosed = new int[] { }; if (vectors.ContainsKey("D") && vectors["D"].Length > 0) { disclosed = Array.ConvertAll <string, int>(vectors["D"].Split(','), new Converter <string, int>(stringToInt)); } int[] undisclosed = new int[5 - disclosed.Length]; int dIndex = 0, uIndex = 0; for (int i = 1; i <= 5; i++) { if (disclosed.Length > 0 && disclosed[dIndex] == i) { dIndex++; } else { undisclosed[uIndex++] = i; } } int[] committed = new int[] { }; if (vectors.ContainsKey("C") && vectors["C"].Length > 0) { committed = Array.ConvertAll <string, int>(vectors["C"].Split(','), new Converter <string, int>(stringToInt)); } byte[] m = HexToBytes(vectors["m"]); byte[] md = HexToBytes(vectors["md"]); IDevicePresentationContext deviceContext = null; if (supportDevice) { deviceContext = device.GetPresentationContext(); } int p = 0; if (vectors.ContainsKey("p") && !int.TryParse(vectors["p"], out p)) { p = PresentationProof.DeviceAttributeIndex; } byte[] s = vectors.ContainsKey("s") ? HexToBytes(vectors["s"]) : null; int commitmentIndex = committed.Length > 0 ? committed[0] : 0; ProverPresentationProtocolParameters pppp = new ProverPresentationProtocolParameters(ip, disclosed, m, upkt[0], A); pppp.Committed = committed; pppp.PseudonymAttributeIndex = p; pppp.PseudonymScope = s; pppp.DeviceMessage = md; pppp.DeviceContext = deviceContext; FieldZqElement[] w = new FieldZqElement[undisclosed.Length]; for (int i = 0; i < undisclosed.Length; i++) { w[i] = Zq.GetElement(HexToBytes(vectors["w" + undisclosed[i]])); } FieldZqElement[] tildeO = new FieldZqElement[committed.Length]; FieldZqElement[] tildeW = new FieldZqElement[committed.Length]; for (int i = 0; i < committed.Length; i++) { tildeO[i] = Zq.GetElement(HexToBytes(vectors["tildeO" + committed[i]])); tildeW[i] = Zq.GetElement(HexToBytes(vectors["tildeW" + committed[i]])); } pppp.RandomData = new ProofGenerationRandomData( Zq.GetElement(HexToBytes(vectors["w0"])), w, supportDevice ? Zq.GetElement(HexToBytes(vectors["wd"])) : null, tildeO, tildeW); CommitmentPrivateValues cpv; PresentationProof proof = PresentationProof.Generate(pppp, out cpv); Assert.IsTrue(HexToBytes(vectors["a"]).SequenceEqual(proof.A), "a"); if (vectors.ContainsKey("gs")) { Assert.AreEqual(ProtocolHelper.GenerateScopeElement(ip.Gq, s), CreateGroupElement(ip.Gq, vectors["gs"])); Assert.IsTrue(HexToBytes(vectors["ap"]).SequenceEqual(proof.Ap), "ap"); Assert.AreEqual(proof.Ps, CreateGroupElement(ip.Gq, vectors["Ps"]), "Ps"); } for (int i = 0; i < disclosed.Length; i++) { Assert.IsTrue(HexToBytes(vectors["A" + disclosed[i]]).SequenceEqual(proof.DisclosedAttributes[i]), "A" + disclosed[i]); } Assert.AreEqual(proof.R[0], Zq.GetElement(HexToBytes(vectors["r0"])), "r0"); for (int i = 0; i < undisclosed.Length; i++) { Assert.AreEqual(proof.R[i + 1], Zq.GetElement(HexToBytes(vectors["r" + undisclosed[i]])), "r" + undisclosed[i]); } if (supportDevice) { Assert.AreEqual(proof.R[proof.R.Length - 1], Zq.GetElement(HexToBytes(vectors["rd"])), "rd"); } for (int i = 0; i < committed.Length; i++) { Assert.AreEqual(proof.Commitments[i].TildeR, Zq.GetElement(HexToBytes(vectors["tildeR" + committed[i]])), "tildeR" + committed[i]); Assert.IsTrue(cpv.TildeO.Length == committed.Length); Assert.AreEqual(cpv.TildeO[i], Zq.GetElement(HexToBytes(vectors["tildeO" + committed[i]])), "tildeO" + committed[i]); } VerifierPresentationProtocolParameters vppp = new VerifierPresentationProtocolParameters(ip, disclosed, m, upkt[0].Token); vppp.Committed = committed; vppp.PseudonymAttributeIndex = p; vppp.PseudonymScope = s; vppp.DeviceMessage = md; proof.Verify(vppp); #if TEST_ID_ESCROW if (committed.Length > 0) { IDEscrowParams escrowParams = new IDEscrowParams(ip); IDEscrowPrivateKey escrowPrivateKey = new IDEscrowPrivateKey(Zq.GetElement(HexToBytes(vectors["ie_x"]))); IDEscrowPublicKey escrowPublicKey = new IDEscrowPublicKey(escrowParams, escrowPrivateKey); Assert.AreEqual(escrowPublicKey.H, CreateGroupElement(ip.Gq, vectors["ie_H"]), "ie_H"); byte[] additionalInfo = HexToBytes(vectors["ie_additionalInfo"]); int ie_bIndex = int.Parse(vectors["ie_b"]); IDEscrowCiphertext ctext = IDEscrowFunctions.VerifiableEncrypt( escrowParams, escrowPublicKey, HexToBytes(vectors["UIDt"]), proof.Commitments[0].TildeC, ProtocolHelper.ComputeXi(ip, ie_bIndex - 1, A[ie_bIndex - 1]), cpv.TildeO[0], additionalInfo, new IDEscrowFunctions.IDEscrowProofGenerationRandomData( Zq.GetElement(HexToBytes(vectors["ie_r"])), Zq.GetElement(HexToBytes(vectors["ie_xbPrime"])), Zq.GetElement(HexToBytes(vectors["ie_rPrime"])), Zq.GetElement(HexToBytes(vectors["ie_obPrime"])))); Assert.IsTrue(IDEscrowFunctions.UProveVerify(escrowParams, ctext, proof, upkt[0].Token, escrowPublicKey)); Assert.AreEqual(ctext.E1, CreateGroupElement(ip.Gq, vectors["ie_E1"]), "ie_E1"); Assert.AreEqual(ctext.E2, CreateGroupElement(ip.Gq, vectors["ie_E2"]), "ie_E2"); Assert.AreEqual(ctext.proof.c, Zq.GetElement(HexToBytes(vectors["ie_c"])), "ie_c"); Assert.AreEqual(ctext.proof.rR, Zq.GetElement(HexToBytes(vectors["ie_rr"])), "ie_rr"); Assert.AreEqual(ctext.proof.rXb, Zq.GetElement(HexToBytes(vectors["ie_rxb"])), "ie_rxb"); Assert.AreEqual(ctext.proof.rOb, Zq.GetElement(HexToBytes(vectors["ie_rob"])), "ie_rob"); GroupElement PE = IDEscrowFunctions.Decrypt(escrowParams, ctext, escrowPrivateKey); } #endif #if TEST_DVA_REVOCATION if (committed.Length > 0) { RAParameters raParams = new RAParameters(ip.Gq.GroupName, CreateGroupElement(ip.Gq, vectors["r_K"]), ip.UidH); FieldZqElement delta = Zq.GetElement(HexToBytes(vectors["r_delta"])); RevocationAuthority RA = new RevocationAuthority(raParams, delta); HashSet <FieldZqElement> revoked = new HashSet <FieldZqElement>(); for (int i = 1; i <= 4; i++) { revoked.Add(Zq.GetElement(HexToBytes(vectors["r_R" + i]))); } RA.UpdateAccumulator(revoked, null); Assert.AreEqual(RA.Accumulator, CreateGroupElement(ip.Gq, vectors["r_V"]), "r_V"); int r_id = 0; int.TryParse(vectors["r_id"], out r_id); RevocationWitness witness = RA.ComputeRevocationWitness(revoked, Zq.GetElement(HexToBytes(vectors["x" + r_id]))); Assert.AreEqual(witness.d, Zq.GetElement(HexToBytes(vectors["r_d"])), "r_d"); Assert.AreEqual(witness.W, CreateGroupElement(ip.Gq, vectors["r_W"]), "r_W"); Assert.AreEqual(witness.Q, CreateGroupElement(ip.Gq, vectors["r_Q"]), "r_Q"); NonRevocationProof nrProof = RevocationUser.GenerateNonRevocationProof( raParams, witness, proof.Commitments[0].TildeC, ProtocolHelper.ComputeXi(ip, r_id - 1, A[r_id - 1]), cpv.TildeO[0], new NonRevocationProofGenerationRandomData(new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["r_t1"])), Zq.GetElement(HexToBytes(vectors["r_t2"])), Zq.GetElement(HexToBytes(vectors["r_k1"])), Zq.GetElement(HexToBytes(vectors["r_k2"])), Zq.GetElement(HexToBytes(vectors["r_k3"])), Zq.GetElement(HexToBytes(vectors["r_k4"])), Zq.GetElement(HexToBytes(vectors["r_k5"])), Zq.GetElement(HexToBytes(vectors["r_k6"])) })); Assert.AreEqual(nrProof.X, CreateGroupElement(ip.Gq, vectors["r_X"]), "r_X"); Assert.AreEqual(nrProof.Y, CreateGroupElement(ip.Gq, vectors["r_Y"]), "r_Y"); Assert.AreEqual(nrProof.Cd, CreateGroupElement(ip.Gq, vectors["r_Cd"]), "r_Cd"); Assert.AreEqual(nrProof.cPrime, Zq.GetElement(HexToBytes(vectors["r_cPrime"])), "r_cPrime"); Assert.AreEqual(nrProof.s[0], Zq.GetElement(HexToBytes(vectors["r_s1"])), "r_s1"); Assert.AreEqual(nrProof.s[1], Zq.GetElement(HexToBytes(vectors["r_s2"])), "r_s2"); Assert.AreEqual(nrProof.s[2], Zq.GetElement(HexToBytes(vectors["r_s3"])), "r_s3"); Assert.AreEqual(nrProof.s[3], Zq.GetElement(HexToBytes(vectors["r_s4"])), "r_s4"); Assert.AreEqual(nrProof.s[4], Zq.GetElement(HexToBytes(vectors["r_s5"])), "r_s5"); Assert.AreEqual(nrProof.s[5], Zq.GetElement(HexToBytes(vectors["r_s6"])), "r_s6"); // validate proof RA.VerifyNonRevocationProof(ip, 0, proof, nrProof); } #endif #if TEST_SET_MEMBERSHIP if (committed.Length > 0) { int sm_x_index = 0; int.TryParse(vectors["sm_x_index"], out sm_x_index); int sm_n = 0; int.TryParse(vectors["sm_n"], out sm_n); int sm_i = 0; int.TryParse(vectors["sm_i"], out sm_i); byte[][] setValues = new byte[sm_n][]; FieldZqElement[] sm_c = new FieldZqElement[sm_n - 1]; FieldZqElement[] sm_r = new FieldZqElement[sm_n - 1]; int randomIndex = 0; for (int i = 1; i <= sm_n; i++) { if (i == sm_i) { setValues[i - 1] = HexToBytes(vectors["A" + sm_x_index]); } else { setValues[i - 1] = HexToBytes(vectors["sm_s" + i]); sm_c[randomIndex] = Zq.GetElement(HexToBytes(vectors["sm_c" + i])); sm_r[randomIndex] = Zq.GetElement(HexToBytes(vectors["sm_r" + i])); randomIndex++; } } SetMembershipProofGenerationRandomData smRandom = new SetMembershipProofGenerationRandomData(sm_c, sm_r, Zq.GetElement(HexToBytes(vectors["sm_w"]))); SetMembershipProof setMembershipProof = SetMembershipProof.Generate(pppp, proof, cpv, sm_x_index, setValues, smRandom); for (int i = 1; i <= sm_n; i++) { Assert.AreEqual(setMembershipProof.a[i - 1], CreateGroupElement(ip.Gq, vectors["sm_a" + i]), "sm_a" + i); if (i < sm_n) // no c_n in the proof { Assert.AreEqual(setMembershipProof.c[i - 1], Zq.GetElement(HexToBytes(vectors["sm_c" + i])), "sm_c" + i); } Assert.AreEqual(setMembershipProof.r[i - 1], Zq.GetElement(HexToBytes(vectors["sm_r" + i])), "sm_r" + i); } if (!SetMembershipProof.Verify(vppp, proof, setMembershipProof, sm_x_index, setValues)) { throw new InvalidUProveArtifactException("Invalid set membership proof"); } } #endif } } } } sw.Stop(); Debug.WriteLine("Protocol Test Elapsed Time: " + sw.ElapsedMilliseconds + "ms"); }
public void ProtocolTest() { Stopwatch sw = new Stopwatch(); sw.Start(); bool[] bools = new bool[] { true, false }; foreach (bool isSubgroupConstruction in bools) { foreach (bool supportDevice in bools) { var vectors = supportDevice ? (isSubgroupConstruction ? GetTestVectors("testvectorssubgroup_Device_doc.txt") : GetTestVectors("testvectorsEC_Device_doc.txt")) : (isSubgroupConstruction ? GetTestVectors("testvectorssubgroup_doc.txt") : GetTestVectors("testvectorsEC_doc.txt")); IssuerKeyAndParameters ikap = LoadIssuerKeyAndParameters(isSubgroupConstruction, vectors["GroupName"], supportDevice, vectors); FieldZq Zq = ikap.IssuerParameters.Zq; // replace random y0/g0 with test vector values ikap.PrivateKey = Zq.GetElement(HexToBytes(vectors["y0"])); ikap.IssuerParameters.G[0] = CreateGroupElement(ikap.IssuerParameters.Gq, vectors["g0"]); Assert.AreEqual(ikap.IssuerParameters.G[0], ikap.IssuerParameters.Gq.G.Exponentiate(ikap.PrivateKey), "g0 computation"); IssuerParameters ip = ikap.IssuerParameters; ip.Verify(); /* * issuance */ byte[][] A = new byte[][] { HexToBytes(vectors["A1"]), HexToBytes(vectors["A2"]), HexToBytes(vectors["A3"]), HexToBytes(vectors["A4"]), HexToBytes(vectors["A5"]) }; Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x1"])), ProtocolHelper.ComputeXi(ip, 0, A[0]), "x1"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x2"])), ProtocolHelper.ComputeXi(ip, 1, A[1]), "x2"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x3"])), ProtocolHelper.ComputeXi(ip, 2, A[2]), "x3"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x4"])), ProtocolHelper.ComputeXi(ip, 3, A[3]), "x4"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["x5"])), ProtocolHelper.ComputeXi(ip, 4, A[4]), "x5"); byte[] TI = HexToBytes(vectors["TI"]); Assert.IsTrue(HexToBytes(vectors["P"]).SequenceEqual(ip.Digest(supportDevice)), "P"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["xt"])), ProtocolHelper.ComputeXt(ip, TI, supportDevice), "xt"); IDevice device = null; GroupElement hd = null; if (supportDevice) { device = new VirtualDevice(ip, Zq.GetElement(HexToBytes(vectors["xd"])), Zq.GetElement(HexToBytes(vectors["wdPrime"]))); IDevicePresentationContext context = device.GetPresentationContext(); // Test device responses Assert.AreEqual(CreateGroupElement(ip.Gq, vectors["hd"]), device.GetDevicePublicKey(), "hd"); Assert.AreEqual(CreateGroupElement(ip.Gq, vectors["ad"]), context.GetInitialWitness(), "ad"); Assert.AreEqual(Zq.GetElement(HexToBytes(vectors["rdPrime"])), context.GetDeviceResponse(HexToBytes(vectors["md"]), HexToBytes(vectors["mdPrime"]), ip.HashFunctionOID), "rdPrime"); hd = CreateGroupElement(ip.Gq, vectors["hd"]); } IssuerProtocolParameters ipp = new IssuerProtocolParameters(ikap); ipp.Attributes = A; ipp.NumberOfTokens = 1; ipp.TokenInformation = TI; ipp.DevicePublicKey = hd; ipp.PreGeneratedW = new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["w"])) }; Issuer issuer = ipp.CreateIssuer(); byte[] PI = HexToBytes(vectors["PI"]); ProverProtocolParameters ppp = new ProverProtocolParameters(ip); ppp.Attributes = A; ppp.NumberOfTokens = 1; ppp.TokenInformation = TI; ppp.ProverInformation = PI; ppp.DevicePublicKey = hd; ppp.ProverRandomData = new ProverRandomData( new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["alpha"])) }, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["beta1"])) }, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["beta2"])) }); Prover prover = ppp.CreateProver(); FirstIssuanceMessage msg1 = issuer.GenerateFirstMessage(); Assert.AreEqual(msg1.sigmaZ, CreateGroupElement(ip.Gq, vectors["sigmaZ"]), "sigmaZ"); Assert.AreEqual(msg1.sigmaA[0], CreateGroupElement(ip.Gq, vectors["sigmaA"]), "sigmaA"); Assert.AreEqual(msg1.sigmaB[0], CreateGroupElement(ip.Gq, vectors["sigmaB"]), "sigmaB"); SecondIssuanceMessage msg2 = prover.GenerateSecondMessage(msg1); Assert.AreEqual(msg2.sigmaC[0], Zq.GetElement(HexToBytes(vectors["sigmaC"])), "sigmaC"); ThirdIssuanceMessage msg3 = issuer.GenerateThirdMessage(msg2); Assert.AreEqual(msg3.sigmaR[0], Zq.GetElement(HexToBytes(vectors["sigmaR"])), "sigmaR"); UProveKeyAndToken[] upkt = prover.GenerateTokens(msg3); Assert.AreEqual(upkt[0].PrivateKey, Zq.GetElement(HexToBytes(vectors["alphaInverse"])), "alphaInverse"); UProveToken token = upkt[0].Token; Assert.AreEqual(token.H, CreateGroupElement(ip.Gq, vectors["h"]), "h"); Assert.AreEqual(token.SigmaZPrime, CreateGroupElement(ip.Gq, vectors["sigmaZPrime"]), "sigmaZPrime"); Assert.AreEqual(token.SigmaCPrime, Zq.GetElement(HexToBytes(vectors["sigmaCPrime"])), "sigmaCPrime"); Assert.AreEqual(token.SigmaRPrime, Zq.GetElement(HexToBytes(vectors["sigmaRPrime"])), "sigmaRPrime"); Assert.IsTrue(HexToBytes(vectors["UIDt"]).SequenceEqual(ProtocolHelper.ComputeTokenID(ip, token)), "UIDt"); Assert.IsTrue(supportDevice == token.IsDeviceProtected); /* * presentation */ int[] disclosed = Array.ConvertAll <string, int>(vectors["D"].Split(','), new Converter <string, int>(stringToInt)); int[] committed = Array.ConvertAll <string, int>(vectors["C"].Split(','), new Converter <string, int>(stringToInt)); byte[] m = HexToBytes(vectors["m"]); byte[] md = null; IDevicePresentationContext deviceContext = null; if (supportDevice) { md = HexToBytes(vectors["md"]); deviceContext = device.GetPresentationContext(); } int p; if (!int.TryParse(vectors["p"], out p)) { p = PresentationProof.DeviceAttributeIndex; } byte[] s = HexToBytes(vectors["s"]); int commitmentIndex = committed[0]; ProverPresentationProtocolParameters pppp = new ProverPresentationProtocolParameters(ip, disclosed, m, upkt[0], A); pppp.Committed = committed; pppp.PseudonymAttributeIndex = p; pppp.PseudonymScope = s; pppp.DeviceMessage = md; pppp.DeviceContext = deviceContext; pppp.RandomData = new ProofGenerationRandomData( Zq.GetElement(HexToBytes(vectors["w0"])), new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["w1"])), Zq.GetElement(HexToBytes(vectors["w3"])), Zq.GetElement(HexToBytes(vectors["w4"])) }, supportDevice ? Zq.GetElement(HexToBytes(vectors["wd"])) : null, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["tildeO" + commitmentIndex])), }, new FieldZqElement[] { Zq.GetElement(HexToBytes(vectors["tildeW" + commitmentIndex])) }); CommitmentPrivateValues cpv; PresentationProof proof = PresentationProof.Generate(pppp, out cpv); Assert.IsTrue(HexToBytes(vectors["a"]).SequenceEqual(proof.A), "a"); Assert.AreEqual(ProtocolHelper.GenerateScopeElement(ip.Gq, s), CreateGroupElement(ip.Gq, vectors["gs"])); Assert.IsTrue(HexToBytes(vectors["ap"]).SequenceEqual(proof.Ap), "ap"); Assert.AreEqual(proof.Ps, CreateGroupElement(ip.Gq, vectors["Ps"]), "Ps"); Assert.IsTrue(HexToBytes(vectors["A2"]).SequenceEqual(proof.DisclosedAttributes[0]), "A2"); Assert.IsTrue(HexToBytes(vectors["A5"]).SequenceEqual(proof.DisclosedAttributes[1]), "A5"); Assert.AreEqual(proof.R[0], Zq.GetElement(HexToBytes(vectors["r0"])), "r0"); Assert.AreEqual(proof.R[1], Zq.GetElement(HexToBytes(vectors["r1"])), "r1"); Assert.AreEqual(proof.R[2], Zq.GetElement(HexToBytes(vectors["r3"])), "r3"); Assert.AreEqual(proof.R[3], Zq.GetElement(HexToBytes(vectors["r4"])), "r4"); if (supportDevice) { Assert.AreEqual(proof.R[4], Zq.GetElement(HexToBytes(vectors["rd"])), "rd"); } Assert.AreEqual(proof.Commitments[0].TildeR, Zq.GetElement(HexToBytes(vectors["tildeR" + commitmentIndex])), "tildeR" + commitmentIndex); Assert.IsTrue(cpv.TildeO.Length == 1); Assert.AreEqual(cpv.TildeO[0], Zq.GetElement(HexToBytes(vectors["tildeO" + commitmentIndex])), "tildeO" + commitmentIndex); VerifierPresentationProtocolParameters vppp = new VerifierPresentationProtocolParameters(ip, disclosed, m, upkt[0].Token); vppp.Committed = committed; vppp.PseudonymAttributeIndex = p; vppp.PseudonymScope = s; vppp.DeviceMessage = md; proof.Verify(vppp); } } sw.Stop(); Debug.WriteLine("Protocol Test Elapsed Time: " + sw.ElapsedMilliseconds + "ms"); }