Disentangle PedersenGens from BulletproofGens

Author: hdevalence

benches/bulletproofs.rs

@@ -4,7 +4,7 @@ extern crate criterion;
 use criterion::Criterion;
 
 extern crate rand;
-use rand::{rngs::OsRng, Rng};
+use rand::Rng;
 
 extern crate curve25519_dalek;
 use curve25519_dalek::scalar::Scalar;
@@ -22,8 +22,9 @@ fn create_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
     c.bench_function_over_inputs(
         &label,
         move |b, &&m| {
-            let generators = BulletproofGens::new(PedersenGens::default(), n, m);
-            let mut rng = OsRng::new().unwrap();
+            let pc_gens = PedersenGens::default();
+            let bp_gens = BulletproofGens::new(n, m);
+            let mut rng = rand::thread_rng();
 
             let (min, max) = (0u64, ((1u128 << n) - 1) as u64);
             let values: Vec<u64> = (0..m).map(|_| rng.gen_range(min, max)).collect();
@@ -34,9 +35,9 @@ fn create_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
                 let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
 
                 RangeProof::prove_multiple(
-                    &generators,
+                    &bp_gens,
+                    &pc_gens,
                     &mut transcript,
-                    &mut rng,
                     &values,
                     &blindings,
                     n,
@@ -69,40 +70,39 @@ fn verify_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
     c.bench_function_over_inputs(
         &label,
         move |b, &&m| {
-            let generators = BulletproofGens::new(PedersenGens::default(), n, m);
-            let mut rng = OsRng::new().unwrap();
+            let pc_gens = PedersenGens::default();
+            let bp_gens = BulletproofGens::new(n, m);
+            let mut rng = rand::thread_rng();
 
             let (min, max) = (0u64, ((1u128 << n) - 1) as u64);
             let values: Vec<u64> = (0..m).map(|_| rng.gen_range(min, max)).collect();
             let blindings: Vec<Scalar> = (0..m).map(|_| Scalar::random(&mut rng)).collect();
 
             let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
             let proof = RangeProof::prove_multiple(
-                &generators,
+                &bp_gens,
+                &pc_gens,
                 &mut transcript,
-                &mut rng,
                 &values,
                 &blindings,
                 n,
             ).unwrap();
 
-            // XXX would be nice to have some convenience API for this
-            let pg = &generators.pedersen_gens;
             let value_commitments: Vec<_> = values
                 .iter()
                 .zip(blindings.iter())
-                .map(|(&v, &v_blinding)| pg.commit(Scalar::from(v), v_blinding))
+                .map(|(&v, &v_blinding)| pc_gens.commit(v.into(), v_blinding))
                 .collect();
 
             b.iter(|| {
                 // Each proof creation requires a clean transcript.
                 let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
 
                 proof.verify(
-                    &value_commitments,
-                    &generators,
+                    &bp_gens,
+                    &pc_gens,
                     &mut transcript,
-                    &mut rng,
+                    &value_commitments,
                     n,
                 )
             });

src/generators.rs

@@ -85,8 +85,6 @@ impl Iterator for GeneratorsChain {
 /// aggregating `m` range proofs of `n` bits each.
 #[derive(Clone)]
 pub struct BulletproofGens {
-    /// Bases for Pedersen commitments
-    pub pedersen_gens: PedersenGens,
     /// The maximum number of usable generators for each party.
     pub gens_capacity: usize,
     /// Number of values or parties
@@ -102,58 +100,46 @@ impl BulletproofGens {
     ///
     /// # Inputs
     ///
-    /// * `pedersen_gens` is a pair of generators used for Pedersen
-    ///    commitments.
     /// * `gens_capacity` is the number of generators to precompute
     ///    for each party.  For rangeproofs, it is sufficient to pass
     ///    `64`, the maximum bitsize of the rangeproofs.  For circuit
     ///    proofs, the capacity must be greater than the number of
     ///    multipliers, rounded up to the next power of two.
     /// * `party_capacity` is the maximum number of parties that can
     ///    produce an aggregated proof.
-    pub fn new(
-        pedersen_gens: PedersenGens,
-        gens_capacity: usize,
-        party_capacity: usize,
-    ) -> Self {
+    pub fn new(gens_capacity: usize, party_capacity: usize) -> Self {
         use byteorder::{ByteOrder, LittleEndian};
 
-        let G_vec = (0..party_capacity)
-            .map(|i| {
-                let party_index = i as u32;
-                let mut label = [b'G', 0, 0, 0, 0];
-                LittleEndian::write_u32(&mut label[1..5], party_index);
-
-                GeneratorsChain::new(&label)
-                    .take(gens_capacity)
-                    .collect::<Vec<_>>()
-            }).collect();
-
-        let H_vec = (0..party_capacity)
-            .map(|i| {
-                let party_index = i as u32;
-                let mut label = [b'H', 0, 0, 0, 0];
-                LittleEndian::write_u32(&mut label[1..5], party_index);
-
-                GeneratorsChain::new(&label)
-                    .take(gens_capacity)
-                    .collect::<Vec<_>>()
-            }).collect();
-
         BulletproofGens {
-            pedersen_gens,
             gens_capacity,
             party_capacity,
-            G_vec,
-            H_vec,
+            G_vec: (0..party_capacity)
+                .map(|i| {
+                    let party_index = i as u32;
+                    let mut label = [b'G', 0, 0, 0, 0];
+                    LittleEndian::write_u32(&mut label[1..5], party_index);
+
+                    GeneratorsChain::new(&label)
+                        .take(gens_capacity)
+                        .collect::<Vec<_>>()
+                }).collect(),
+            H_vec: (0..party_capacity)
+                .map(|i| {
+                    let party_index = i as u32;
+                    let mut label = [b'H', 0, 0, 0, 0];
+                    LittleEndian::write_u32(&mut label[1..5], party_index);
+
+                    GeneratorsChain::new(&label)
+                        .take(gens_capacity)
+                        .collect::<Vec<_>>()
+                }).collect(),
         }
     }
 
     /// Returns j-th share of generators, with an appropriate
     /// slice of vectors G and H for the j-th range proof.
     pub fn share(&self, j: usize) -> BulletproofGensShare {
         BulletproofGensShare {
-            pedersen_gens: &self.pedersen_gens,
             gens: &self,
             share: j,
         }
@@ -221,8 +207,6 @@ impl<'a> Iterator for AggregatedGensIter<'a> {
 /// represents the generators for one of the `m` parties' shares.
 #[derive(Copy, Clone)]
 pub struct BulletproofGensShare<'a> {
-    /// Bases for Pedersen commitments
-    pub pedersen_gens: &'a PedersenGens,
     /// The parent object that this is a view into
     gens: &'a BulletproofGens,
     /// Which share we are
@@ -248,7 +232,7 @@ mod tests {
 
     #[test]
     fn aggregated_gens_iter_matches_flat_map() {
-        let gens = BulletproofGens::new(PedersenGens::default(), 64, 8);
+        let gens = BulletproofGens::new(64, 8);
 
         let helper = |n: usize, m: usize| {
             let agg_G: Vec<RistrettoPoint> = gens.G(n, m).cloned().collect();

src/inner_product_proof.rs

@@ -336,10 +336,10 @@ mod tests {
     fn test_helper_create(n: usize) {
         let mut rng = OsRng::new().unwrap();
 
-        use generators::{BulletproofGens, PedersenGens};
-        let gens = BulletproofGens::new(PedersenGens::default(), n, 1);
-        let G: Vec<RistrettoPoint> = gens.share(0).G(n).cloned().collect();
-        let H: Vec<RistrettoPoint> = gens.share(0).H(n).cloned().collect();
+        use generators::BulletproofGens;
+        let bp_gens = BulletproofGens::new(n, 1);
+        let G: Vec<RistrettoPoint> = bp_gens.share(0).G(n).cloned().collect();
+        let H: Vec<RistrettoPoint> = bp_gens.share(0).H(n).cloned().collect();
 
         // Q would be determined upstream in the protocol, so we pick a random one.
         let Q = RistrettoPoint::hash_from_bytes::<Sha3_512>(b"test point");

src/range_proof/dealer.rs

@@ -7,10 +7,9 @@
 use curve25519_dalek::ristretto::RistrettoPoint;
 use curve25519_dalek::scalar::Scalar;
 use merlin::Transcript;
-use rand::{CryptoRng, Rng};
 
 use errors::MPCError;
-use generators::BulletproofGens;
+use generators::{BulletproofGens, PedersenGens};
 use inner_product_proof;
 use range_proof::RangeProof;
 use transcript::TranscriptProtocol;
@@ -25,21 +24,22 @@ pub struct Dealer {}
 impl Dealer {
     /// Creates a new dealer coordinating `m` parties proving `n`-bit ranges.
     pub fn new<'a, 'b>(
-        gens: &'b BulletproofGens,
+        bp_gens: &'b BulletproofGens,
+        pc_gens: &'b PedersenGens,
+        transcript: &'a mut Transcript,
         n: usize,
         m: usize,
-        transcript: &'a mut Transcript,
     ) -> Result<DealerAwaitingValueCommitments<'a, 'b>, MPCError> {
         if !(n == 8 || n == 16 || n == 32 || n == 64) {
             return Err(MPCError::InvalidBitsize);
         }
         if !m.is_power_of_two() {
             return Err(MPCError::InvalidAggregation);
         }
-        if gens.gens_capacity < n {
+        if bp_gens.gens_capacity < n {
             return Err(MPCError::InvalidGeneratorsLength);
         }
-        if gens.party_capacity < m {
+        if bp_gens.party_capacity < m {
             return Err(MPCError::InvalidGeneratorsLength);
         }
 
@@ -60,25 +60,27 @@ impl Dealer {
         transcript.rangeproof_domain_sep(n as u64, m as u64);
 
         Ok(DealerAwaitingValueCommitments {
-            n,
-            m,
+            bp_gens,
+            pc_gens,
             transcript,
             initial_transcript,
-            gens,
+            n,
+            m,
         })
     }
 }
 
 /// The initial dealer state, waiting for the parties to send value
 /// commitments.
 pub struct DealerAwaitingValueCommitments<'a, 'b> {
-    n: usize,
-    m: usize,
+    bp_gens: &'b BulletproofGens,
+    pc_gens: &'b PedersenGens,
     transcript: &'a mut Transcript,
     /// The dealer keeps a copy of the initial transcript state, so
     /// that it can attempt to verify the aggregated proof at the end.
     initial_transcript: Transcript,
-    gens: &'b BulletproofGens,
+    n: usize,
+    m: usize,
 }
 
 impl<'a, 'b> DealerAwaitingValueCommitments<'a, 'b> {
@@ -114,7 +116,8 @@ impl<'a, 'b> DealerAwaitingValueCommitments<'a, 'b> {
                 m: self.m,
                 transcript: self.transcript,
                 initial_transcript: self.initial_transcript,
-                gens: self.gens,
+                bp_gens: self.bp_gens,
+                pc_gens: self.pc_gens,
                 value_challenge,
                 value_commitments,
                 A,
@@ -130,7 +133,8 @@ pub struct DealerAwaitingPolyCommitments<'a, 'b> {
     m: usize,
     transcript: &'a mut Transcript,
     initial_transcript: Transcript,
-    gens: &'b BulletproofGens,
+    bp_gens: &'b BulletproofGens,
+    pc_gens: &'b PedersenGens,
     value_challenge: ValueChallenge,
     value_commitments: Vec<ValueCommitment>,
     /// Aggregated commitment to the parties' bits
@@ -164,7 +168,8 @@ impl<'a, 'b> DealerAwaitingPolyCommitments<'a, 'b> {
                 m: self.m,
                 transcript: self.transcript,
                 initial_transcript: self.initial_transcript,
-                gens: self.gens,
+                bp_gens: self.bp_gens,
+                pc_gens: self.pc_gens,
                 value_challenge: self.value_challenge,
                 value_commitments: self.value_commitments,
                 A: self.A,
@@ -184,7 +189,8 @@ pub struct DealerAwaitingProofShares<'a, 'b> {
     m: usize,
     transcript: &'a mut Transcript,
     initial_transcript: Transcript,
-    gens: &'b BulletproofGens,
+    bp_gens: &'b BulletproofGens,
+    pc_gens: &'b PedersenGens,
     value_challenge: ValueChallenge,
     value_commitments: Vec<ValueCommitment>,
     poly_challenge: PolyChallenge,
@@ -217,7 +223,7 @@ impl<'a, 'b> DealerAwaitingProofShares<'a, 'b> {
 
         // Get a challenge value to combine statements for the IPP
         let w = self.transcript.challenge_scalar(b"w");
-        let Q = w * self.gens.pedersen_gens.B;
+        let Q = w * self.pc_gens.B;
 
         let l_vec: Vec<Scalar> = proof_shares
             .iter()
@@ -232,8 +238,8 @@ impl<'a, 'b> DealerAwaitingProofShares<'a, 'b> {
             self.transcript,
             &Q,
             util::exp_iter(self.value_challenge.y.invert()),
-            self.gens.G(self.n, self.m).cloned().collect(),
-            self.gens.H(self.n, self.m).cloned().collect(),
+            self.bp_gens.G(self.n, self.m).cloned().collect(),
+            self.bp_gens.H(self.n, self.m).cloned().collect(),
             l_vec,
             r_vec,
         );
@@ -258,25 +264,25 @@ impl<'a, 'b> DealerAwaitingProofShares<'a, 'b> {
     /// error.
     ///
     /// XXX define error types so we can surface the blame info
-    pub fn receive_shares<R: Rng + CryptoRng>(
-        mut self,
-        rng: &mut R,
-        proof_shares: &[ProofShare],
-    ) -> Result<RangeProof, MPCError> {
+    pub fn receive_shares(mut self, proof_shares: &[ProofShare]) -> Result<RangeProof, MPCError> {
         let proof = self.assemble_shares(proof_shares)?;
 
         let V: Vec<_> = self.value_commitments.iter().map(|vc| vc.V_j).collect();
 
         // See comment in `Dealer::new` for why we use `initial_transcript`
         let transcript = &mut self.initial_transcript;
-        if proof.verify(&V, self.gens, transcript, rng, self.n).is_ok() {
+        if proof
+            .verify(self.bp_gens, self.pc_gens, transcript, &V, self.n)
+            .is_ok()
+        {
             Ok(proof)
         } else {
             // Proof verification failed. Now audit the parties:
             let mut bad_shares = Vec::new();
             for j in 0..self.m {
                 match proof_shares[j].audit_share(
-                    &self.gens,
+                    &self.bp_gens,
+                    &self.pc_gens,
                     j,
                     &self.value_commitments[j],
                     &self.value_challenge,