Add a party capacity to the Generators

Co-authored-by: Cathie Yun <[email protected]>

Author: hdevalence

src/generators.rs

@@ -88,48 +88,64 @@ pub struct Generators {
     /// Bases for Pedersen commitments
     pub pedersen_gens: PedersenGenerators,
     /// The maximum number of usable generators for each party.
-    capacity: usize,
+    pub gens_capacity: usize,
     /// Number of values or parties
-    parties: usize,
+    pub party_capacity: usize,
     /// Per-bit generators for the bit values
     G_vec: Vec<Vec<RistrettoPoint>>,
     /// Per-bit generators for the bit blinding factors
     H_vec: Vec<Vec<RistrettoPoint>>,
 }
 
 impl Generators {
-    /// Creates `capacity` generators for the given number of `parties`.
-    pub fn new(pedersen_gens: PedersenGenerators, capacity: usize, parties: usize) -> Self {
+    /// Create a new `Generators` object.
+    ///
+    /// # Inputs
+    ///
+    /// * `pedersen_gens` is a pair of generators used for Pedersen
+    ///    commitments.
+    /// * `gens_capacity` is the number of generators to precompute
+    ///    for each party.  For rangeproofs, it is sufficient to pass
+    ///    `64`, the maximum bitsize of the rangeproofs.  For circuit
+    ///    proofs, the capacity must be greater than the number of
+    ///    multipliers, rounded up to the next power of two.
+    /// * `party_capacity` is the maximum number of parties that can
+    ///    produce an aggregated proof.
+    pub fn new(
+        pedersen_gens: PedersenGenerators,
+        gens_capacity: usize,
+        party_capacity: usize,
+    ) -> Self {
         use byteorder::{ByteOrder, LittleEndian};
 
-        let G_vec = (0..parties)
+        let G_vec = (0..party_capacity)
             .map(|i| {
                 let party_index = i as u32;
                 let mut label = [b'G', 0, 0, 0, 0];
                 LittleEndian::write_u32(&mut label[1..5], party_index);
 
                 GeneratorsChain::new(&label)
-                    .take(capacity)
+                    .take(gens_capacity)
                     .collect::<Vec<_>>()
             })
             .collect();
 
-        let H_vec = (0..parties)
+        let H_vec = (0..party_capacity)
             .map(|i| {
                 let party_index = i as u32;
                 let mut label = [b'H', 0, 0, 0, 0];
                 LittleEndian::write_u32(&mut label[1..5], party_index);
 
                 GeneratorsChain::new(&label)
-                    .take(capacity)
+                    .take(gens_capacity)
                     .collect::<Vec<_>>()
             })
             .collect();
 
         Generators {
             pedersen_gens,
-            capacity,
-            parties,
+            gens_capacity,
+            party_capacity,
             G_vec,
             H_vec,
         }
@@ -145,25 +161,22 @@ impl Generators {
         }
     }
 
-    /// Get the maximum number of generators that can be used in a proof.
-    pub fn capacity(&self) -> usize {
-        self.capacity
-    }
-
     /// Return an iterator over the aggregation of the parties' G generators with given size `n`.
-    pub(crate) fn G(&self, n: usize) -> impl Iterator<Item = &RistrettoPoint> {
+    pub(crate) fn G(&self, n: usize, m: usize) -> impl Iterator<Item = &RistrettoPoint> {
         AggregatedGensIter {
             n,
+            m,
             array: &self.G_vec,
             party_idx: 0,
             gen_idx: 0,
         }
     }
 
     /// Return an iterator over the aggregation of the parties' H generators with given size `n`.
-    pub(crate) fn H(&self, n: usize) -> impl Iterator<Item = &RistrettoPoint> {
+    pub(crate) fn H(&self, n: usize, m: usize) -> impl Iterator<Item = &RistrettoPoint> {
         AggregatedGensIter {
             n,
+            m,
             array: &self.H_vec,
             party_idx: 0,
             gen_idx: 0,
@@ -174,6 +187,7 @@ impl Generators {
 struct AggregatedGensIter<'a> {
     array: &'a Vec<Vec<RistrettoPoint>>,
     n: usize,
+    m: usize,
     party_idx: usize,
     gen_idx: usize,
 }
@@ -187,7 +201,7 @@ impl<'a> Iterator for AggregatedGensIter<'a> {
             self.party_idx += 1;
         }
 
-        if self.party_idx >= self.array.len() {
+        if self.party_idx >= self.m {
             None
         } else {
             let cur_gen = self.gen_idx;
@@ -197,7 +211,7 @@ impl<'a> Iterator for AggregatedGensIter<'a> {
     }
 
     fn size_hint(&self) -> (usize, Option<usize>) {
-        let size = self.n * self.array.len();
+        let size = self.n * self.m;
         (size, Some(size))
     }
 }
@@ -240,19 +254,21 @@ mod tests {
     fn aggregated_gens_iter_matches_flat_map() {
         let gens = Generators::new(PedersenGenerators::default(), 64, 8);
 
-        let helper = |n: usize| {
-            let agg_G: Vec<RistrettoPoint> = gens.G(n).cloned().collect();
+        let helper = |n: usize, m: usize| {
+            let agg_G: Vec<RistrettoPoint> = gens.G(n, m).cloned().collect();
             let flat_G: Vec<RistrettoPoint> = gens
                 .G_vec
                 .iter()
+                .take(m)
                 .flat_map(move |G_j| G_j.iter().take(n))
                 .cloned()
                 .collect();
 
-            let agg_H: Vec<RistrettoPoint> = gens.H(n).cloned().collect();
+            let agg_H: Vec<RistrettoPoint> = gens.H(n, m).cloned().collect();
             let flat_H: Vec<RistrettoPoint> = gens
                 .H_vec
                 .iter()
+                .take(m)
                 .flat_map(move |H_j| H_j.iter().take(n))
                 .cloned()
                 .collect();
@@ -261,9 +277,17 @@ mod tests {
             assert_eq!(agg_H, flat_H);
         };
 
-        helper(64);
-        helper(32);
-        helper(16);
-        helper(8);
+        helper(64, 8);
+        helper(64, 4);
+        helper(64, 2);
+        helper(64, 1);
+        helper(32, 8);
+        helper(32, 4);
+        helper(32, 2);
+        helper(32, 1);
+        helper(16, 8);
+        helper(16, 4);
+        helper(16, 2);
+        helper(16, 1);
     }
 }

src/range_proof/dealer.rs

@@ -226,8 +226,8 @@ impl<'a, 'b> DealerAwaitingProofShares<'a, 'b> {
             self.transcript,
             &Q,
             util::exp_iter(self.value_challenge.y.invert()),
-            self.gens.G(self.n).cloned().collect(),
-            self.gens.H(self.n).cloned().collect(),
+            self.gens.G(self.n, self.m).cloned().collect(),
+            self.gens.H(self.n, self.m).cloned().collect(),
             l_vec,
             r_vec,
         );

src/range_proof/mod.rs

@@ -82,7 +82,7 @@ impl RangeProof {
         if !(n == 8 || n == 16 || n == 32 || n == 64) {
             return Err(ProofError::InvalidBitsize);
         }
-        if generators.capacity() < n {
+        if generators.gens_capacity < n {
             return Err(ProofError::InvalidGeneratorsLength);
         }
 
@@ -155,7 +155,7 @@ impl RangeProof {
         if !(n == 8 || n == 16 || n == 32 || n == 64) {
             return Err(ProofError::InvalidBitsize);
         }
-        if gens.capacity() < n {
+        if gens.gens_capacity < n {
             return Err(ProofError::InvalidGeneratorsLength);
         }
 
@@ -235,8 +235,8 @@ impl RangeProof {
                 .chain(self.ipp_proof.R_vec.iter().map(|R| R.decompress()))
                 .chain(iter::once(Some(gens.pedersen_gens.B_blinding)))
                 .chain(iter::once(Some(gens.pedersen_gens.B)))
-                .chain(gens.G(n).map(|&x| Some(x)))
-                .chain(gens.H(n).map(|&x| Some(x)))
+                .chain(gens.G(n, m).map(|&x| Some(x)))
+                .chain(gens.H(n, m).map(|&x| Some(x)))
                 .chain(value_commitments.iter().map(|&x| Some(x))),
         ).ok_or_else(|| ProofError::VerificationError)?;
 
@@ -407,7 +407,9 @@ mod tests {
         use bincode;
 
         // Both prover and verifier have access to the generators and the proof
-        let generators = Generators::new(PedersenGenerators::default(), n, m);
+        let max_bitsize = 64;
+        let max_parties = 8;
+        let generators = Generators::new(PedersenGenerators::default(), max_bitsize, max_parties);
 
         // Serialized proof data
         let proof_bytes: Vec<u8>;