Update sigma-proofs to the mu/draft-v3 API

Cargo.toml

@@ -10,7 +10,7 @@ description = "Crate for automatically generating code for sigma zero-knowledge
 group = "0.13"
 rand = "0.8.5"
 sigma-compiler-derive = "=0.2.3"
-sigma-proofs = "0.3.2"
+sigma-proofs = { git = "https://github.com/sigma-rs/sigma-proofs", branch = "mu/draft-v3" }
 subtle = "2.6"
 
 [dev-dependencies]

README.md

@@ -23,9 +23,8 @@ The pieces are as follows:
      structures and code associated with this sigma protocol.
   - `<Grp>`: an optional indication of the mathematical group to use
     (a set of `Point`s and associated `Scalar`s) for this sigma
-    protocol.  The group must implement the
-    [`PrimeGroup`]
-    trait.  If `<Grp>` is omitted, it defaults to assuming there is
+    protocol.  The group must implement the [`PrimeGroup`] 
+    trait. If `<Grp>` is omitted, it defaults to assuming there is
     a group called `G` in the current scope.
   - `scalar_list` is a list of variables representing `Scalar`s.
     Each variable can be optionally tagged with one or more of the
@@ -180,7 +179,7 @@ The macro creates a submodule with the name specified by
         witness: &Witness,
         session_id: &[u8],
         rng: &mut (impl CryptoRng + RngCore),
-    ) -> sigma_proofs::errors::Result<Vec<u8>>
+    ) -> Result<Vec<u8>, sigma_proofs::errors::InvalidWitness>
     ```
     The parameter `instance` contains the public variables (also
     known to the verifier).  The parameter `witness` contains the
@@ -189,15 +188,17 @@ The macro creates a submodule with the name specified by
     byte slice, and the verifier must use the same byte slice in
     order to verify the proof.  The parameter `rng` is a random
     number generator that implements the [`CryptoRng`] and
-    [`RngCore`] traits.  The output, if successful, is the proof as
-    a byte vector.
+    [`RngCore`] traits and supplies compiler-generated random scalars.
+    The underlying sigma proof obtains its randomness from the OS through
+    `sigma_proofs::prove_compact`.  The output, if successful, is the proof
+    as a byte vector.
   - A function `verify` with the signature
     ```
     pub fn verify(
         instance: &Instance,
         proof: &[u8],
         session_id: &[u8],
-    ) -> sigma_proofs::errors::Result<()>
+    ) -> Result<(), sigma_proofs::errors::VerificationError>
     ```
     The parameter `instance` contains the public variables, and must
     be the same as passed to the `prove` function.  The parameter

sigma-compiler-core/src/codegen.rs

@@ -412,7 +412,7 @@ impl CodeGen {
                     #witness_var: &Witness,
                     #sid_var: &[u8],
                     #rng_var: &mut (impl CryptoRng + RngCore),
-                ) -> Result<Vec<u8>, SigmaError> {
+                ) -> Result<Vec<u8>, InvalidWitness> {
                     #dumper
                     let Instance { #instance_ids } = #instance_var.clone();
                     let Witness { #witness_ids } = #witness_var.clone();
@@ -431,7 +431,6 @@ impl CodeGen {
                             &#codegen_instance_var,
                             &#codegen_witness_var,
                             #sid_var,
-                            #rng_var,
                         )?
                     );
                     Ok(#proof_var)
@@ -468,7 +467,7 @@ impl CodeGen {
                         let #id: Point = {
                             let end = #offset_var + #element_len_var;
                             if #proof_var.len() < end {
-                                return Err(SigmaError::VerificationFailure);
+                                return Err(VerificationError);
                             }
                             let mut repr = <Point as group::GroupEncoding>::Repr::default();
                             repr.as_mut()
@@ -477,7 +476,7 @@ impl CodeGen {
                             Option::<Point>::from(
                                 <Point as group::GroupEncoding>::from_bytes(&repr)
                             )
-                            .ok_or(SigmaError::VerificationFailure)?
+                            .ok_or(VerificationError)?
                         };
                     },
                     StructField::VecPoint(id) => quote! {
@@ -487,7 +486,7 @@ impl CodeGen {
                             for _ in 0..expected_len {
                                 let end = #offset_var + #element_len_var;
                                 if #proof_var.len() < end {
-                                    return Err(SigmaError::VerificationFailure);
+                                    return Err(VerificationError);
                                 }
                                 let mut repr =
                                     <Point as group::GroupEncoding>::Repr::default();
@@ -497,7 +496,7 @@ impl CodeGen {
                                 let point = Option::<Point>::from(
                                     <Point as group::GroupEncoding>::from_bytes(&repr)
                                 )
-                                .ok_or(SigmaError::VerificationFailure)?;
+                                .ok_or(VerificationError)?;
                                 points.push(point);
                             }
                             #id = points;
@@ -538,7 +537,7 @@ impl CodeGen {
                     #instance_var: &Instance,
                     #proof_var: &[u8],
                     #sid_var: &[u8],
-                ) -> Result<(), SigmaError> {
+                ) -> Result<(), VerificationError> {
                     #dumper
                     let Instance { #instance_ids } = #instance_var.clone();
                     #verify_pre_instance_code
@@ -576,7 +575,9 @@ impl CodeGen {
                 use sigma_compiler::group::ff::{Field, PrimeField};
                 use sigma_compiler::rand::{CryptoRng, RngCore};
                 use sigma_compiler::sigma_proofs;
-                use sigma_compiler::sigma_proofs::errors::Error as SigmaError;
+                use sigma_compiler::sigma_proofs::errors::{
+                    InvalidInstance, InvalidWitness, VerificationError,
+                };
                 use sigma_compiler::subtle::ConditionallySelectable;
                 use sigma_compiler::vecutils::*;
                 use std::ops::Neg;

sigma-compiler-core/src/notequals.rs

@@ -273,7 +273,7 @@ pub fn transform(
             let #Lx_var = #Lx_code;
             let #j_var = <Scalar as Field>::invert(&#Lx_var)
                 .into_option()
-                .ok_or(SigmaError::VerificationFailure)?;
+                .ok_or(InvalidWitness)?;
             let #s_var = -#rand_var * #j_var;
         });
 

sigma-compiler-core/src/pubscalareq.rs

@@ -80,7 +80,10 @@ pub fn transform(
                                     // verifier to directly check the statement.
                                     codegen.prove_verify_append(quote! {
                                         if #id != #right_tokens {
-                                            return Err(SigmaError::VerificationFailure);
+                                            return Err(InvalidInstance::new(concat!(
+                                                "public scalar equality does not hold: ",
+                                                stringify!(#id),
+                                            )).into());
                                         }
                                     });
 

sigma-compiler-core/src/rangeproof.rs

@@ -403,7 +403,9 @@ pub fn transform(
             if #bitrep_scalars_var.is_empty() {
                 // The upper bound was either less than 2, or more than
                 // i128::MAX
-                return Err(SigmaError::VerificationFailure);
+                return Err(InvalidInstance::new(
+                    "range upper bound has no bit representation",
+                ).into());
             }
             let #nbits_var = #bitrep_scalars_var.len();
         });

sigma-compiler-core/src/sigma/codegen.rs

@@ -202,10 +202,10 @@ impl<'a> CodeGen<'a> {
     }
 
     /// Generate the code for the `protocol` and `protocol_witness`
-    /// functions that create the `ComposedRelation` and `ComposedWitness`
+    /// functions that create the `ComposedInstance` and `ComposedWitness`
     /// structs, respectively, given a slice of [`Expr`]s that will be
     /// bundled into a single `LinearRelation`.  The `protocol` code
-    /// must evaluate to a `Result<ComposedRelation>` and the `protocol_witness`
+    /// must evaluate to a `Result<ComposedInstance>` and the `protocol_witness`
     /// code must evaluate to a `Result<ComposedWitness>`.
     fn linear_relation_codegen(&self, exprs: &[&Expr]) -> (TokenStream, TokenStream) {
         let instance_var = format_ident!("{}instance", self.unique_prefix);
@@ -386,12 +386,11 @@ impl<'a> CodeGen<'a> {
                     param_vec_code = quote! {
                         #param_vec_code
                         if #vec_len_var != #instance_var.#thisvar.len() {
-                            eprintln!(
+                            return Err(InvalidInstance::new(format!(
                                 "Instance variables {} and {} must have the same length",
                                 stringify!(#firstvar),
                                 stringify!(#thisvar),
-                            );
-                            return Err(SigmaError::VerificationFailure);
+                            )));
                         }
                     };
                 }
@@ -410,7 +409,7 @@ impl<'a> CodeGen<'a> {
                                 stringify!(#firstvar),
                                 stringify!(#witvar),
                             );
-                            return Err(SigmaError::VerificationFailure);
+                            return Err(InvalidWitness);
                         }
                     }
                 }
@@ -453,7 +452,7 @@ impl<'a> CodeGen<'a> {
                     #eq_code
                     #element_assigns
 
-                    SigmaOk(ComposedRelation::try_from(#lr_var).unwrap())
+                    ComposedInstance::try_from(#lr_var)
                 }
             },
             quote! {
@@ -461,7 +460,7 @@ impl<'a> CodeGen<'a> {
                     #witness_vec_code
                     let mut witnessvec = Vec::new();
                     #witness_code
-                    SigmaOk(ComposedWitness::Simple(witnessvec))
+                    Result::<_, InvalidWitness>::Ok(ComposedWitness::Simple(witnessvec))
                 }
             },
         )
@@ -481,10 +480,10 @@ impl<'a> CodeGen<'a> {
             // leaf "true")
             StatementTree::Leaf(_) if statement.is_leaf_true() => (
                 quote! {
-                    Ok(ComposedRelation::try_from(LinearRelation::<Point>::new()).unwrap())
+                    ComposedInstance::try_from(LinearRelation::<Point>::new())
                 },
                 quote! {
-                    Ok(ComposedWitness::Simple(vec![]))
+                    Result::<_, InvalidWitness>::Ok(ComposedWitness::Simple(vec![]))
                 },
             ),
             // The StatementTree is a single statement.  Generate a
@@ -516,13 +515,13 @@ impl<'a> CodeGen<'a> {
                             .unzip();
                     (
                         quote! {
-                            SigmaOk(ComposedRelation::and([
+                            ComposedInstance::and([
                                 #proto_code?,
                                 #(#others_proto?,)*
-                            ]))
+                            ])
                         },
                         quote! {
-                            SigmaOk(ComposedWitness::and([
+                            Result::<_, InvalidWitness>::Ok(ComposedWitness::and([
                                 #witness_code?,
                                 #(#others_witness?,)*
                             ]))
@@ -537,12 +536,12 @@ impl<'a> CodeGen<'a> {
                     .unzip();
                 (
                     quote! {
-                        SigmaOk(ComposedRelation::or([
+                        ComposedInstance::or([
                             #(#proto?,)*
-                        ]))
+                        ])
                     },
                     quote! {
-                        SigmaOk(ComposedWitness::or([
+                        Result::<_, InvalidWitness>::Ok(ComposedWitness::or([
                             #(#witness?,)*
                         ]))
                     },
@@ -555,12 +554,12 @@ impl<'a> CodeGen<'a> {
                     .unzip();
                 (
                     quote! {
-                        SigmaOk(ComposedRelation::threshold(#thresh, [
+                        ComposedInstance::threshold(#thresh, [
                             #(#proto?,)*
-                        ]))
+                        ])
                     },
                     quote! {
-                        SigmaOk(ComposedWitness::threshold([
+                        Result::<_, InvalidWitness>::Ok(ComposedWitness::threshold([
                             #(#witness?,)*
                         ]))
                     },
@@ -666,7 +665,7 @@ impl<'a> CodeGen<'a> {
             quote! {
                 fn protocol(
                     #instance_var: &Instance,
-                ) -> SigmaResult<ComposedRelation<Point>> {
+                ) -> Result<ComposedInstance<Point>, InvalidInstance> {
                     #protocol_code
                 }
             }
@@ -678,7 +677,7 @@ impl<'a> CodeGen<'a> {
                 fn protocol_witness(
                     instance: &Instance,
                     witness: &Witness,
-                ) -> SigmaResult<ComposedWitness<Point>> {
+                ) -> Result<ComposedWitness<Point>, InvalidWitness> {
                     #witness_code
                 }
             }
@@ -691,23 +690,20 @@ impl<'a> CodeGen<'a> {
             let instance_var = format_ident!("{}instance", self.unique_prefix);
             let witness_var = format_ident!("{}witness", self.unique_prefix);
             let session_id_var = format_ident!("{}session_id", self.unique_prefix);
-            let rng_var = format_ident!("{}rng", self.unique_prefix);
             let proto_var = format_ident!("{}proto", self.unique_prefix);
             let proto_witness_var = format_ident!("{}proto_witness", self.unique_prefix);
-            let nizk_var = format_ident!("{}nizk", self.unique_prefix);
 
             quote! {
                 pub fn prove(
                     #instance_var: &Instance,
                     #witness_var: &Witness,
                     #session_id_var: &[u8],
-                    #rng_var: &mut (impl CryptoRng + RngCore),
-                ) -> SigmaResult<Vec<u8>> {
+                ) -> Result<Vec<u8>, InvalidWitness> {
                     let #proto_var = protocol(#instance_var)?;
                     let #proto_witness_var = protocol_witness(#instance_var, #witness_var)?;
-                    let #nizk_var = #proto_var.into_nizk(#session_id_var);
-
-                    #nizk_var.prove_compact(&#proto_witness_var, #rng_var)
+                    sigma_proofs::prove_compact(
+                        #session_id_var, &#proto_var, &#proto_witness_var,
+                    )
                 }
             }
         } else {
@@ -720,18 +716,15 @@ impl<'a> CodeGen<'a> {
             let proof_var = format_ident!("{}proof", self.unique_prefix);
             let session_id_var = format_ident!("{}session_id", self.unique_prefix);
             let proto_var = format_ident!("{}proto", self.unique_prefix);
-            let nizk_var = format_ident!("{}nizk", self.unique_prefix);
 
             quote! {
                 pub fn verify(
                     #instance_var: &Instance,
                     #proof_var: &[u8],
                     #session_id_var: &[u8],
-                ) -> SigmaResult<()> {
+                ) -> Result<(), VerificationError> {
                     let #proto_var = protocol(#instance_var)?;
-                    let #nizk_var = #proto_var.into_nizk(#session_id_var);
-
-                    #nizk_var.verify_compact(#proof_var)
+                    sigma_proofs::verify_compact(#session_id_var, &#proto_var, #proof_var)
                 }
             }
         } else {
@@ -752,15 +745,12 @@ impl<'a> CodeGen<'a> {
                 use super::sigma_compiler;
                 use sigma_compiler::sigma_proofs;
                 use sigma_compiler::group::ff::PrimeField;
-                use sigma_compiler::rand::{CryptoRng, RngCore};
                 use sigma_compiler::subtle::CtOption;
                 use sigma_compiler::vecutils::*;
                 use sigma_proofs::{
-                    composition::{ComposedRelation, ComposedWitness},
-                    errors::Error as SigmaError,
-                    errors::Ok as SigmaOk,
-                    errors::Result as SigmaResult,
-                    LinearRelation, Nizk,
+                    composition::{ComposedInstance, ComposedWitness},
+                    errors::{InvalidInstance, InvalidWitness, VerificationError},
+                    LinearRelation,
                 };
                 use std::ops::Neg;
                 #dump_use

sigma-compiler-core/src/substitution.rs

@@ -156,7 +156,7 @@ pub fn transform(
                                 // for illegal inputs (but is constant time for
                                 // valid inputs)
                                 if #id != #right_tokens {
-                                    return Err(SigmaError::VerificationFailure);
+                                    return Err(InvalidWitness);
                                 }
                             });
                         }

src/rangeutils.rs

@@ -2,7 +2,7 @@
 //! processing of range statements.
 
 use group::ff::PrimeField;
-use sigma_proofs::errors::Error;
+use sigma_proofs::errors::InvalidInstance;
 use subtle::Choice;
 
 /// Convert a [`Scalar`] to an [`u128`], assuming it fits in an [`i128`]
@@ -67,13 +67,14 @@ pub fn bit_decomp<S: PrimeField>(mut s: S, nbits: u32) -> Vec<Choice> {
 /// constant time.
 ///
 /// [`Scalar`]: https://docs.rs/group/0.13.0/group/trait.Group.html#associatedtype.Scalar
-pub fn bitrep_scalars_vartime<S: PrimeField>(upper: S) -> Result<Vec<S>, Error> {
+pub fn bitrep_scalars_vartime<S: PrimeField>(upper: S) -> Result<Vec<S>, InvalidInstance> {
     // Get the `u128` value of `upper`, and its number of bits `nbits`
-    let (upper_val, mut nbits) = bit_decomp_vartime(upper).ok_or(Error::VerificationFailure)?;
+    let (upper_val, mut nbits) = bit_decomp_vartime(upper)
+        .ok_or_else(|| InvalidInstance::new("range upper bound exceeds i128::MAX"))?;
 
     // Ensure `nbits` is at least 2.
     if nbits < 2 {
-        return Err(Error::VerificationFailure);
+        return Err(InvalidInstance::new("range upper bound must be at least 2"));
     }
 
     // If upper is exactly a power of 2, use one fewer bit
@@ -207,7 +208,7 @@ mod tests {
     // Obliviously test whether x is in 0..upper (that is, 0 <= x <
     // upper) using bit decomposition.  `upper` is considered public,
     // but `x` is private.  `upper` must be at least 2.
-    fn bitrep_tester(upper: Scalar, x: Scalar, expected: bool) -> Result<(), Error> {
+    fn bitrep_tester(upper: Scalar, x: Scalar, expected: bool) -> Result<(), InvalidInstance> {
         let rep_scalars = bitrep_scalars_vartime(upper)?;
         let bitrep = compute_bitrep(x, &rep_scalars);
 
@@ -219,7 +220,9 @@ mod tests {
         }
 
         if (x == x_out) != expected {
-            return Err(Error::VerificationFailure);
+            return Err(InvalidInstance::new(
+                "bit representation disagrees with the range",
+            ));
         }
 
         Ok(())

tests/basic.rs

@@ -6,7 +6,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn basic_test() -> sigma_proofs::errors::Result<()> {
+fn basic_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, z, rand r, rand s),
         (C, D, const cind A, const cind B),
@@ -30,5 +30,5 @@ fn basic_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, z, r, s };
 
     let proof = proof::prove(&instance, &witness, b"basic_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"basic_test")
+    Ok(proof::verify(&instance, &proof, b"basic_test")?)
 }

tests/basic_sum.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn basic_sum_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn basic_sum_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, y, rand vec r, rand s),
         (vec C, D, const cind A, const cind B),
@@ -29,7 +29,7 @@ fn basic_sum_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"basic_sum_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"basic_sum_test")
+    Ok(proof::verify(&instance, &proof, b"basic_sum_test")?)
 }
 
 #[test]

tests/basic_vec.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn basic_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn basic_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, rand vec r),
         (vec C, const cind A, const cind B),
@@ -24,7 +24,7 @@ fn basic_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, r };
 
     let proof = proof::prove(&instance, &witness, b"basic_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"basic_vec_test")
+    Ok(proof::verify(&instance, &proof, b"basic_vec_test")?)
 }
 
 #[test]

tests/disj.rs

@@ -6,7 +6,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn disj_test() -> sigma_proofs::errors::Result<()> {
+fn disj_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, rand r),
         (C, const cind A, const cind B),

tests/disj_vec.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn disj_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn disj_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, vec y, pub vec a, rand vec r, rand vec s),
         (vec C, vec D, const cind A, const cind B),
@@ -39,7 +39,7 @@ fn disj_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"disj_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"disj_vec_test")
+    Ok(proof::verify(&instance, &proof, b"disj_vec_test")?)
 }
 
 #[test]

tests/dl.rs

@@ -4,7 +4,7 @@ use group::Group;
 use sigma_compiler::*;
 
 #[test]
-fn dl_zero_test() -> sigma_proofs::errors::Result<()> {
+fn dl_zero_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x),
         (C, const B),
@@ -21,11 +21,11 @@ fn dl_zero_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"dl_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"dl_test")
+    Ok(proof::verify(&instance, &proof, b"dl_test")?)
 }
 
 #[test]
-fn dl_one_test() -> sigma_proofs::errors::Result<()> {
+fn dl_one_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x),
         (C, const B),
@@ -42,5 +42,5 @@ fn dl_one_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"dl_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"dl_test")
+    Ok(proof::verify(&instance, &proof, b"dl_test")?)
 }

tests/dot_product.rs

@@ -3,7 +3,7 @@ use curve25519_dalek::ristretto::RistrettoPoint as G;
 use group::Group;
 use sigma_compiler::*;
 
-fn dot_product_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn dot_product_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, pub vec a),
         (C, D, E, F, vec A, B),
@@ -37,7 +37,7 @@ fn dot_product_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()>
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"dot_product_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"dot_product_test")
+    Ok(proof::verify(&instance, &proof, b"dot_product_test")?)
 }
 
 #[test]

tests/emptystatement.rs

@@ -3,7 +3,7 @@ use curve25519_dalek::ristretto::RistrettoPoint as G;
 use sigma_compiler::*;
 
 #[test]
-fn emptystatement_test() -> sigma_proofs::errors::Result<()> {
+fn emptystatement_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (),
         (),
@@ -15,5 +15,5 @@ fn emptystatement_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness {};
 
     let proof = proof::prove(&instance, &witness, b"emptystatement_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"emptystatement_test")
+    Ok(proof::verify(&instance, &proof, b"emptystatement_test")?)
 }

tests/left_expr.rs

@@ -6,7 +6,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn left_expr_test() -> sigma_proofs::errors::Result<()> {
+fn left_expr_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, y, pub a, rand r, rand s),
         (C, D, const cind A, const cind B),
@@ -30,11 +30,11 @@ fn left_expr_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"left_expr_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"left_expr_test")
+    Ok(proof::verify(&instance, &proof, b"left_expr_test")?)
 }
 
 #[test]
-fn left_expr_vec_test() -> sigma_proofs::errors::Result<()> {
+fn left_expr_vec_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, vec y, z, pub vec a, pub b, rand vec r, rand vec s, rand t),
         (vec C, vec D, E, const cind A, const cind B),
@@ -78,5 +78,5 @@ fn left_expr_vec_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, y, z, r, s, t };
 
     let proof = proof::prove(&instance, &witness, b"left_expr_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"left_expr_vec_test")
+    Ok(proof::verify(&instance, &proof, b"left_expr_vec_test")?)
 }

tests/notequals.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn do_test(x_u128: u128) -> sigma_proofs::errors::Result<()> {
+fn do_test(x_u128: u128) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, rand r),
         (C, const cind A, const cind B),
@@ -25,7 +25,7 @@ fn do_test(x_u128: u128) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, r };
 
     let proof = proof::prove(&instance, &witness, b"notequals_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"notequals_test")
+    Ok(proof::verify(&instance, &proof, b"notequals_test")?)
 }
 
 #[test]

tests/pubscalars.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn pubscalars_test_val(b_val: u128) -> sigma_proofs::errors::Result<()> {
+fn pubscalars_test_val(b_val: u128) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, z, rand r, rand s, pub a, pub b),
         (C, D, const cind A, const cind B),
@@ -32,7 +32,7 @@ fn pubscalars_test_val(b_val: u128) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, z, r, s };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_test")?)
 }
 
 #[test]

tests/pubscalars_or.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn pubscalars_or_test_val(b_val: u128) -> sigma_proofs::errors::Result<()> {
+fn pubscalars_or_test_val(b_val: u128) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, rand r, pub a, pub b),
         (C, const cind A, const cind B),
@@ -30,7 +30,7 @@ fn pubscalars_or_test_val(b_val: u128) -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, r };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_or_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_or_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_or_test")?)
 }
 
 #[test]

tests/pubscalars_or_and.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn pubscalars_or_and_test_val(x_val: u128, b_val: u128) -> sigma_proofs::errors::Result<()> {
+fn pubscalars_or_and_test_val(x_val: u128, b_val: u128) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, rand r, pub a, pub b),
         (C, const cind A, const cind B),
@@ -36,7 +36,7 @@ fn pubscalars_or_and_test_val(x_val: u128, b_val: u128) -> sigma_proofs::errors:
     let witness = proof::Witness { x, r };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_or_and_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_or_and_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_or_and_test")?)
 }
 
 #[test]

tests/pubscalars_or_and_vec.rs

@@ -9,7 +9,7 @@ fn pubscalars_or_vec_test_vecsize_val(
     vecsize: usize,
     b_val: u128,
     x_val: Option<u128>,
-) -> sigma_proofs::errors::Result<()> {
+) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, vec y, pub vec a, pub vec b, rand vec r, rand vec s),
         (vec C, vec D, const cind A, const cind B),
@@ -56,7 +56,7 @@ fn pubscalars_or_vec_test_vecsize_val(
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_vec_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_vec_test")?)
 }
 
 fn pubscalars_or_vec_emptyvec() {

tests/pubscalars_or_vec.rs

@@ -8,7 +8,7 @@ use sigma_compiler::*;
 fn pubscalars_or_vec_test_vecsize_val(
     vecsize: usize,
     b_val: u128,
-) -> sigma_proofs::errors::Result<()> {
+) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, pub vec a, pub vec b, rand vec r),
         (vec C, const cind A, const cind B),
@@ -37,7 +37,7 @@ fn pubscalars_or_vec_test_vecsize_val(
     let witness = proof::Witness { x, r };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_vec_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_vec_test")?)
 }
 
 #[test]

tests/pubscalars_vec.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn pubscalars_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn pubscalars_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, vec y, pub vec a, pub vec b, rand vec r, rand vec s),
         (vec C, vec D, const cind A, const cind B),
@@ -36,7 +36,7 @@ fn pubscalars_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<(
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"pubscalars_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubscalars_vec_test")
+    Ok(proof::verify(&instance, &proof, b"pubscalars_vec_test")?)
 }
 
 #[test]

tests/pubstatements.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sigma_compiler::*;
 
 #[test]
-fn pubstatements_test() -> sigma_proofs::errors::Result<()> {
+fn pubstatements_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, pub a),
         (C, D, const cind B),
@@ -25,5 +25,5 @@ fn pubstatements_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"pubstatements_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubstatements_test")
+    Ok(proof::verify(&instance, &proof, b"pubstatements_test")?)
 }

tests/pubstatements_vec.rs

@@ -4,7 +4,7 @@ use group::ff::PrimeField;
 use group::Group;
 use sigma_compiler::*;
 
-fn pubstatements_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn pubstatements_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, pub vec a),
         (vec C, vec D, const cind B),
@@ -24,7 +24,7 @@ fn pubstatements_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Resul
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"pubstatements_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"pubstatements_vec_test")
+    Ok(proof::verify(&instance, &proof, b"pubstatements_vec_test")?)
 }
 
 #[test]

tests/range.rs

@@ -6,7 +6,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn range_test() -> sigma_proofs::errors::Result<()> {
+fn range_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, y, pub a, rand r),
         (C, D, const cind A, const cind B),
@@ -31,5 +31,5 @@ fn range_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, y, r };
 
     let proof = proof::prove(&instance, &witness, b"range_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"range_test")
+    Ok(proof::verify(&instance, &proof, b"range_test")?)
 }

tests/range_dump.rs

@@ -7,7 +7,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn range_dump_test() -> sigma_proofs::errors::Result<()> {
+fn range_dump_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, y, pub a, rand r),
         (C, D, const cind A, const cind B),
@@ -39,5 +39,5 @@ fn range_dump_test() -> sigma_proofs::errors::Result<()> {
     let buf = sigma_compiler::dumper::dump_buffer();
     print!("{buf}");
 
-    res
+    Ok(res?)
 }

tests/simple_or.rs

@@ -5,7 +5,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn simple_or_test() -> sigma_proofs::errors::Result<()> {
+fn simple_or_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, y),
         (C, const cind A, const cind B),

tests/substitution_or.rs

@@ -6,7 +6,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn substitution_or_test() -> sigma_proofs::errors::Result<()> {
+fn substitution_or_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, z, rand r, rand s),
         (C, D, const cind A, const cind B),
@@ -33,5 +33,5 @@ fn substitution_or_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x, z, r, s };
 
     let proof = proof::prove(&instance, &witness, b"substitution_or_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"substitution_or_test")
+    Ok(proof::verify(&instance, &proof, b"substitution_or_test")?)
 }

tests/substitution_vec.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn substitution_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn substitution_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x, vec y, rand vec r, rand vec s),
         (vec C, vec D, const cind A, const cind B),
@@ -29,7 +29,7 @@ fn substitution_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result
     let witness = proof::Witness { x, y, r, s };
 
     let proof = proof::prove(&instance, &witness, b"substitution_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"substitution_vec_test")
+    Ok(proof::verify(&instance, &proof, b"substitution_vec_test")?)
 }
 
 #[test]

tests/subtract.rs

@@ -4,7 +4,7 @@ use group::Group;
 use sigma_compiler::*;
 
 #[test]
-fn subtract_test() -> sigma_proofs::errors::Result<()> {
+fn subtract_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x),
         (C, const cind B),
@@ -21,5 +21,5 @@ fn subtract_test() -> sigma_proofs::errors::Result<()> {
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"subtract_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"subtract_test")
+    Ok(proof::verify(&instance, &proof, b"subtract_test")?)
 }

tests/subtract_vec.rs

@@ -5,7 +5,7 @@ use group::Group;
 use sha2::Sha512;
 use sigma_compiler::*;
 
-fn subtract_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()> {
+fn subtract_vec_test_vecsize(vecsize: usize) -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (vec x),
         (vec C, vec D, vec E, const cind A, const cind B),
@@ -33,7 +33,7 @@ fn subtract_vec_test_vecsize(vecsize: usize) -> sigma_proofs::errors::Result<()>
     let witness = proof::Witness { x };
 
     let proof = proof::prove(&instance, &witness, b"subtract_vec_test", &mut rng)?;
-    proof::verify(&instance, &proof, b"subtract_vec_test")
+    Ok(proof::verify(&instance, &proof, b"subtract_vec_test")?)
 }
 
 #[test]

tests/threshold.rs

@@ -5,7 +5,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn threshold_test() -> sigma_proofs::errors::Result<()> {
+fn threshold_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { thresh3,
         (x1, x2, x3, x4, x5, rand r),
         (C, const cind G0, const cind G1, const cind G2, const cind G3,
@@ -54,14 +54,15 @@ fn threshold_test() -> sigma_proofs::errors::Result<()> {
         };
 
         match thresh3::prove(&instance, &witness, b"thresh_test", &mut rng) {
-            Ok(_) if num_true < 3 => {
-                panic!("THRESH passed when it should have failed (true_pattern = {true_pattern})")
-            }
             Err(_) if num_true >= 3 => {
                 panic!("THRESH failed when it should have passed (true_pattern = {true_pattern})")
             }
             Ok(proof) => {
-                thresh3::verify(&instance, &proof, b"thresh_test")?;
+                assert_eq!(
+                    thresh3::verify(&instance, &proof, b"thresh_test").is_ok(),
+                    num_true >= 3,
+                    "incorrect threshold verdict (true_pattern = {true_pattern})",
+                );
             }
             Err(_) => {}
         }

tests/threshold_pubscalars.rs

@@ -5,7 +5,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn threshold_pubscalars_test() -> sigma_proofs::errors::Result<()> {
+fn threshold_pubscalars_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { thresh3,
         (pub x1, pub x2, pub x3, pub x4, pub x5, rand r),
         (C, const cind G0, const cind G1, const cind G2, const cind G3,
@@ -52,14 +52,15 @@ fn threshold_pubscalars_test() -> sigma_proofs::errors::Result<()> {
         let witness = thresh3::Witness { r };
 
         match thresh3::prove(&instance, &witness, b"thresh_pubscalars_test", &mut rng) {
-            Ok(_) if num_true < 3 => {
-                panic!("THRESH passed when it should have failed (true_pattern = {true_pattern})")
-            }
             Err(_) if num_true >= 3 => {
                 panic!("THRESH failed when it should have passed (true_pattern = {true_pattern})")
             }
             Ok(proof) => {
-                thresh3::verify(&instance, &proof, b"thresh_pubscalars_test")?;
+                assert_eq!(
+                    thresh3::verify(&instance, &proof, b"thresh_pubscalars_test").is_ok(),
+                    num_true >= 3,
+                    "incorrect threshold verdict (true_pattern = {true_pattern})",
+                );
             }
             Err(_) => {}
         }

tests/two_true.rs

@@ -5,7 +5,7 @@ use sha2::Sha512;
 use sigma_compiler::*;
 
 #[test]
-fn two_true_test() -> sigma_proofs::errors::Result<()> {
+fn two_true_test() -> Result<(), Box<dyn std::error::Error>> {
     sigma_compiler! { proof,
         (x, y),
         (C, D, const cind A, const cind B),