Add additional validation to R1CS proof points.

This follows the same logic as in the rangeproof case: we don't have an a
priori reason to think that there's a security problem with allowing these
points to be the identity, but this is an area where people make mistakes in
under-specification of assumptions, etc., and there is no valid reason for
these points to be the identity, so this works as a defense-in-depth mechanism.

The extra validation is not applied to the value commitments, in order to allow
commitments to the zero value with zero blinding factor.

Author: hdevalence

src/r1cs/verifier.rs

@@ -331,9 +331,9 @@ impl<'t> Verifier<'t> {
         self.transcript.append_u64(b"m", self.V.len() as u64);
 
         let n1 = self.num_vars;
-        self.transcript.append_point(b"A_I1", &proof.A_I1);
-        self.transcript.append_point(b"A_O1", &proof.A_O1);
-        self.transcript.append_point(b"S1", &proof.S1);
+        self.transcript.validate_and_append_point(b"A_I1", &proof.A_I1)?;
+        self.transcript.validate_and_append_point(b"A_O1", &proof.A_O1)?;
+        self.transcript.validate_and_append_point(b"S1", &proof.S1)?;
 
         // Process the remaining constraints.
         self = self.create_randomized_constraints()?;
@@ -354,18 +354,19 @@ impl<'t> Verifier<'t> {
         // We are performing a single-party circuit proof, so party index is 0.
         let gens = bp_gens.share(0);
 
+        // These points are the identity in the 1-phase unrandomized case.
         self.transcript.append_point(b"A_I2", &proof.A_I2);
         self.transcript.append_point(b"A_O2", &proof.A_O2);
         self.transcript.append_point(b"S2", &proof.S2);
 
         let y = self.transcript.challenge_scalar(b"y");
         let z = self.transcript.challenge_scalar(b"z");
 
-        self.transcript.append_point(b"T_1", &proof.T_1);
-        self.transcript.append_point(b"T_3", &proof.T_3);
-        self.transcript.append_point(b"T_4", &proof.T_4);
-        self.transcript.append_point(b"T_5", &proof.T_5);
-        self.transcript.append_point(b"T_6", &proof.T_6);
+        self.transcript.validate_and_append_point(b"T_1", &proof.T_1)?;
+        self.transcript.validate_and_append_point(b"T_3", &proof.T_3)?;
+        self.transcript.validate_and_append_point(b"T_4", &proof.T_4)?;
+        self.transcript.validate_and_append_point(b"T_5", &proof.T_5)?;
+        self.transcript.validate_and_append_point(b"T_6", &proof.T_6)?;
 
         let u = self.transcript.challenge_scalar(b"u");
         let x = self.transcript.challenge_scalar(b"x");