22
33use ark_ec:: CurveGroup ;
44use ark_poly:: { DenseUVPolynomial , Polynomial , univariate:: DensePolynomial } ;
5+ use ark_serialize:: serialize_to_vec;
56use ark_std:: marker:: PhantomData ;
67use ark_std:: rand:: Rng ;
78use std:: { iter:: successors, num:: NonZeroU32 } ;
@@ -29,6 +30,44 @@ impl FeldmanVssPublicParam {
2930 }
3031}
3132
33+ impl < C : CurveGroup > FeldmanVss < C > {
34+ /// sample a random polynomial for VSS `secret`, returns the poly and its feldman commitment
35+ pub ( crate ) fn rand_poly_and_commit < R : Rng > (
36+ pp : & FeldmanVssPublicParam ,
37+ secret : C :: ScalarField ,
38+ rng : & mut R ,
39+ ) -> ( DensePolynomial < C :: ScalarField > , Vec < C :: Affine > ) {
40+ // sample random polynomial of degree t-1 (s.t. any t evaluations can interpolate this poly)
41+ // f(X) = Sum a_i * X^i
42+ let mut poly = DensePolynomial :: < C :: ScalarField > :: rand ( pp. t . get ( ) as usize - 1 , rng) ;
43+ // f(0) = a_0 set to the secret, this index access will never panic since t>0
44+ poly. coeffs [ 0 ] = secret;
45+
46+ // prepare commitment, u = (g^a_0, g^a_1, ..., g^a_t-1)
47+ let commitment = C :: generator ( ) . batch_mul ( & poly. coeffs ) ;
48+
49+ ( poly, commitment)
50+ }
51+
52+ /// given a secret-embedded polynomial, compute the Shamir secret shares
53+ /// node i \in {0,.. ,n-1} get f(i+1)
54+ pub ( crate ) fn compute_shares (
55+ pp : & FeldmanVssPublicParam ,
56+ poly : & DensePolynomial < C :: ScalarField > ,
57+ ) -> impl Iterator < Item = C :: ScalarField > {
58+ ( 0 ..pp. n . get ( ) ) . map ( |node_idx| poly. evaluate ( & ( node_idx + 1 ) . into ( ) ) )
59+ }
60+
61+ /// same as [`Self::compute_shares()`], but output an iterator of bytes
62+ pub ( crate ) fn compute_serialized_shares (
63+ pp : & FeldmanVssPublicParam ,
64+ poly : & DensePolynomial < C :: ScalarField > ,
65+ ) -> impl Iterator < Item = Vec < u8 > > {
66+ Self :: compute_shares ( pp, poly)
67+ . map ( |s| serialize_to_vec ! [ s] . expect ( "ark_serialize valid shares never panic" ) )
68+ }
69+ }
70+
3271impl < C : CurveGroup > VerifiableSecretSharing for FeldmanVss < C > {
3372 type PublicParam = FeldmanVssPublicParam ;
3473 type Secret = C :: ScalarField ;
@@ -40,29 +79,17 @@ impl<C: CurveGroup> VerifiableSecretSharing for FeldmanVss<C> {
4079 rng : & mut R ,
4180 secret : Self :: Secret ,
4281 ) -> ( Vec < Self :: SecretShare > , Self :: Commitment ) {
43- // sample random polynomial of degree t-1 (s.t. any t evaluations can interpolate this poly)
44- // f(X) = Sum a_i * X^i
45- let mut poly = DensePolynomial :: < Self :: Secret > :: rand ( pp. t . get ( ) as usize - 1 , rng) ;
46- // f(0) = a_0 set to the secret, this index access will never panic since t>0
47- poly. coeffs [ 0 ] = secret;
48-
49- // prepare shares, node i \in {0,.. ,n-1} get f(i+1)
50- let shares: Vec < Self :: SecretShare > = ( 0 ..pp. n . get ( ) )
51- . map ( |node_idx| poly. evaluate ( & ( node_idx + 1 ) . into ( ) ) )
52- . collect ( ) ;
53-
54- // prepare commitment, u = (g^a_0, g^a_1, ..., g^a_t-1)
55- let commitment = C :: generator ( ) . batch_mul ( & poly. coeffs ) ;
56-
57- ( shares, commitment)
82+ let ( poly, comm) = Self :: rand_poly_and_commit ( pp, secret, rng) ;
83+ let shares = Self :: compute_shares ( pp, & poly) . collect ( ) ;
84+ ( shares, comm)
5885 }
5986
6087 fn verify (
6188 pp : & Self :: PublicParam ,
6289 node_idx : usize ,
6390 share : & Self :: SecretShare ,
6491 commitment : & Self :: Commitment ,
65- ) -> Result < bool , VssError > {
92+ ) -> Result < ( ) , VssError > {
6693 let n = pp. n . get ( ) as usize ;
6794 let t = pp. t . get ( ) as usize ;
6895
@@ -86,7 +113,11 @@ impl<C: CurveGroup> VerifiableSecretSharing for FeldmanVss<C> {
86113 VssError :: InternalError ( "commitments and powers mismatched length" . to_string ( ) )
87114 } ) ?;
88115
89- Ok ( C :: generator ( ) . mul ( share) == eval_in_exp)
116+ if C :: generator ( ) . mul ( share) == eval_in_exp {
117+ Ok ( ( ) )
118+ } else {
119+ Err ( VssError :: FailedVerification )
120+ }
90121 }
91122
92123 fn reconstruct (
@@ -140,29 +171,27 @@ mod tests {
140171 let ( shares, commitment) = FeldmanVss :: < C > :: share ( & pp, rng, secret) ;
141172 for ( node_idx, s) in shares. iter ( ) . enumerate ( ) {
142173 // happy path
143- assert ! ( FeldmanVss :: <C >:: verify( & pp, node_idx, s, & commitment) . unwrap ( ) ) ;
174+ assert ! ( FeldmanVss :: <C >:: verify( & pp, node_idx, s, & commitment) . is_ok ( ) ) ;
144175
145176 // sad path
146177 // wrong node_idx should fail
147- assert ! (
148- !FeldmanVss :: <C >:: verify( & pp, node_idx + 1 , s, & commitment) . unwrap_or( false )
149- ) ;
178+ assert ! ( FeldmanVss :: <C >:: verify( & pp, node_idx + 1 , s, & commitment) . is_err( ) ) ;
150179
151180 // wrong secret share should fail
152181 assert ! (
153- ! FeldmanVss :: <C >:: verify(
182+ FeldmanVss :: <C >:: verify(
154183 & pp,
155184 node_idx,
156185 & C :: ScalarField :: rand( rng) ,
157186 & commitment,
158187 )
159- . unwrap ( )
188+ . is_err ( )
160189 ) ;
161190
162191 // wrong commitment should fail
163192 let mut bad_comm = commitment. clone ( ) ;
164193 bad_comm[ 1 ] = C :: Affine :: default ( ) ;
165- assert ! ( ! FeldmanVss :: <C >:: verify( & pp, node_idx, s, & bad_comm) . unwrap ( ) ) ;
194+ assert ! ( FeldmanVss :: <C >:: verify( & pp, node_idx, s, & bad_comm) . is_err ( ) ) ;
166195
167196 // incomplete/dropped commitment should fail
168197 bad_comm. pop ( ) ;
0 commit comments