Главная Обзор Помощь
Вход
Michele Orrù orru
Репозитории Активность

orru запушил(а) mu/draft-v3 в SigmaProtocol/sigma-compiler

  • 4457e39c76 docs: update instance codegen terminology

1 неделя назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/sigma-compiler

  • 58b813c9e8 feat: automatically reuse the reserved identity and generator elements
  • 5e7139a21f Update to the released sigma-proofs 0.4 API Migrate generated protocols to the draft-v3 API using released sigma-proofs 0.4 and spongefish 0.8. Update group, curve, and RNG dependencies and APIs to match the released versions.
  • 4701c18021 feat: automatically reuse the reserved identity and generator elements
  • d37062087b Update to the released sigma-proofs 0.4 API Migrate generated protocols to the draft-v3 API using released sigma-proofs 0.4 and spongefish 0.8. Update group, curve, and RNG dependencies and APIs to match the released versions.
  • Просмотр сравнение для этих 4 коммитов »

2 недель назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/cmz

  • 5e7b23a75b feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • 78b1cbdb32 refactor: build the basepoints only on the call that loads them `cmz_group_init` built a `CMZBasepoints` and handed it to `load_bp`, which then dropped it on the floor unless the map was empty -- and `load_bp` cloned it when it was not. Callers invoke this on every request, so take a closure and construct only on the call that actually populates the map. By itself that is a shape fix, not a measured win: `wnaf_is_constant_time` is not a default feature and nothing enables it, so `CMZBasepoints` is `{A_, B_}` and construction plus clone costs about 8ns. It matters under that feature, where construction is two WnafBase tables. The cost callers actually pay is the argument, not the call: `cmz_group_init(G::hash_from_bytes::<Sha512>(...))` evaluates the hash-to-curve eagerly, at roughly 4.7us per request, and nothing on the callee side can reach it. So `cmz_group_init_with` takes the generator as a closure too, and the hash happens once, on the call that initializes. Both sides of a round trip call this, so it is roughly 9us a round trip for a one-word change at each call site. `cmz_group_init` is unchanged. (cherry picked from commit 0b8a6fbbb7f06aa68d6a00c60efdfe555e9ac528)
  • c953d8bdfe fix: key the basepoints map on the group type `StaticTypeMap::call_once::<Type, _>` looks the entry up by `TypeId::of::<Type>()`, and this passed `Box<dyn CMZbp>` -- the same type for every group. So the map held one slot shared by all groups rather than one per group, which is the whole point of the design described at length above it: a second `cmz_group_init` for a different group was ignored, and the following `cmz_basepoints` read back the first group's basepoints and panicked in the downcast. Key on `G` instead. This makes previously-panicking programs work, so it is a behaviour change and kept apart from the refactor that follows it. tests/two_groups.rs covers it, and needs a second curve: cmz had only curve25519-dalek available, so p256 joins the dev-dependencies. (cherry picked from commit 25aa8f25cfeb28e995665eba3d946287b841742d)
  • 955c44ccb1 Update sigma-compiler and released proof dependencies Use the draft-v3 sigma-compiler Git dependency with released sigma-proofs 0.4 and spongefish 0.8. Update the group, curve, hash-to-group, and RNG dependencies and APIs to match the released versions.
  • 73d40e01cc feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • Просмотр сравнение для этих 8 коммитов »

2 недель назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/sigma-compiler

  • 4701c18021 feat: automatically reuse the reserved identity and generator elements
  • d37062087b Update to the released sigma-proofs 0.4 API Migrate generated protocols to the draft-v3 API using released sigma-proofs 0.4 and spongefish 0.8. Update group, curve, and RNG dependencies and APIs to match the released versions.
  • 27f65b4ab4 feat: automatically reuse the reserved identity and generator elements
  • a1a59b3fe6 Update to the released sigma-proofs 0.4 API Migrate generated protocols to the draft-v3 API using released sigma-proofs 0.4 and spongefish 0.8. Update group, curve, and RNG dependencies and APIs to match the released versions.
  • Просмотр сравнение для этих 4 коммитов »

2 недель назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/cmz

  • 73d40e01cc feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • 485975d29a refactor: build the basepoints only on the call that loads them `cmz_group_init` built a `CMZBasepoints` and handed it to `load_bp`, which then dropped it on the floor unless the map was empty -- and `load_bp` cloned it when it was not. Callers invoke this on every request, so take a closure and construct only on the call that actually populates the map. By itself that is a shape fix, not a measured win: `wnaf_is_constant_time` is not a default feature and nothing enables it, so `CMZBasepoints` is `{A_, B_}` and construction plus clone costs about 8ns. It matters under that feature, where construction is two WnafBase tables. The cost callers actually pay is the argument, not the call: `cmz_group_init(G::hash_from_bytes::<Sha512>(...))` evaluates the hash-to-curve eagerly, at roughly 4.7us per request, and nothing on the callee side can reach it. So `cmz_group_init_with` takes the generator as a closure too, and the hash happens once, on the call that initializes. Both sides of a round trip call this, so it is roughly 9us a round trip for a one-word change at each call site. `cmz_group_init` is unchanged. (cherry picked from commit 0b8a6fbbb7f06aa68d6a00c60efdfe555e9ac528)
  • bc97fd4080 fix: key the basepoints map on the group type `StaticTypeMap::call_once::<Type, _>` looks the entry up by `TypeId::of::<Type>()`, and this passed `Box<dyn CMZbp>` -- the same type for every group. So the map held one slot shared by all groups rather than one per group, which is the whole point of the design described at length above it: a second `cmz_group_init` for a different group was ignored, and the following `cmz_basepoints` read back the first group's basepoints and panicked in the downcast. Key on `G` instead. This makes previously-panicking programs work, so it is a behaviour change and kept apart from the refactor that follows it. tests/two_groups.rs covers it, and needs a second curve: cmz had only curve25519-dalek available, so p256 joins the dev-dependencies. (cherry picked from commit 25aa8f25cfeb28e995665eba3d946287b841742d)
  • 27e918c36e Update sigma-compiler and released proof dependencies Use the draft-v3 sigma-compiler Git dependency with released sigma-proofs 0.4 and spongefish 0.8. Update the group, curve, hash-to-group, and RNG dependencies and APIs to match the released versions.
  • 4861abd581 test: derive rate-limit epoch bases with RFC 9380
  • Просмотр сравнение для этих 11 коммитов »

2 недель назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/sigma-compiler

  • 27f65b4ab4 feat: automatically reuse the reserved identity and generator elements
  • a1a59b3fe6 Update to the released sigma-proofs 0.4 API Migrate generated protocols to the draft-v3 API using released sigma-proofs 0.4 and spongefish 0.8. Update group, curve, and RNG dependencies and APIs to match the released versions.
  • f783ddb367 chore: patch sigma-proofs and spongefish to their mu/draft-v3 branches
  • c70bf20df3 feat: automatically reuse the canonical group generator
  • 8dce96b838 feat: emit public-scalar claims under disjunctions as constant-shape claim branches
  • Просмотр сравнение для этих 6 коммитов »

2 недель назад

orru запушил(а) mu/draft-v3-2 в SigmaProtocol/cmz

  • de5f2c83be feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • 13b2721243 refactor: build the basepoints only on the call that loads them `cmz_group_init` built a `CMZBasepoints` and handed it to `load_bp`, which then dropped it on the floor unless the map was empty -- and `load_bp` cloned it when it was not. Callers invoke this on every request, so take a closure and construct only on the call that actually populates the map. By itself that is a shape fix, not a measured win: `wnaf_is_constant_time` is not a default feature and nothing enables it, so `CMZBasepoints` is `{A_, B_}` and construction plus clone costs about 8ns. It matters under that feature, where construction is two WnafBase tables. The cost callers actually pay is the argument, not the call: `cmz_group_init(G::hash_from_bytes::<Sha512>(...))` evaluates the hash-to-curve eagerly, at roughly 4.7us per request, and nothing on the callee side can reach it. So `cmz_group_init_with` takes the generator as a closure too, and the hash happens once, on the call that initializes. Both sides of a round trip call this, so it is roughly 9us a round trip for a one-word change at each call site. `cmz_group_init` is unchanged. (cherry picked from commit 0b8a6fbbb7f06aa68d6a00c60efdfe555e9ac528)
  • de350ac0a9 fix: key the basepoints map on the group type `StaticTypeMap::call_once::<Type, _>` looks the entry up by `TypeId::of::<Type>()`, and this passed `Box<dyn CMZbp>` -- the same type for every group. So the map held one slot shared by all groups rather than one per group, which is the whole point of the design described at length above it: a second `cmz_group_init` for a different group was ignored, and the following `cmz_basepoints` read back the first group's basepoints and panicked in the downcast. Key on `G` instead. This makes previously-panicking programs work, so it is a behaviour change and kept apart from the refactor that follows it. tests/two_groups.rs covers it, and needs a second curve: cmz had only curve25519-dalek available, so p256 joins the dev-dependencies. (cherry picked from commit 25aa8f25cfeb28e995665eba3d946287b841742d)
  • 411602a4a4 Update sigma-compiler and released proof dependencies Use the draft-v3 sigma-compiler Git dependency with released sigma-proofs 0.4 and spongefish 0.8. Update the group, curve, hash-to-group, and RNG dependencies and APIs to match the released versions.
  • 2251cc03c3 feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • Просмотр сравнение для этих 8 коммитов »

1 месяц назад

orru запушил(а) mu/draft-v3-2 в SigmaProtocol/sigma-compiler

1 месяц назад

orru запушил(а) mu/draft-v3-2 в SigmaProtocol/sigma-compiler

  • 9b66900708 feat: automatically reuse the reserved identity and generator elements
  • 7e728c82d5 Update sigma-proofs to the mu/draft-v3 API
  • c1c1ed28e1 Update version to 0.2.3 Depend on sigma-proofs 0.3.2
  • b855630aff Don't warn if variables produced by the code generator end up unused
  • 125461ef37 Remove unused variable from two tests

1 месяц назад

orru создал новую ветку mu/draft-v3-2 в SigmaProtocol/sigma-compiler

1 месяц назад

orru запушил(а) mu/draft-v3-2 в SigmaProtocol/cmz

  • 2251cc03c3 feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup. (cherry picked from commit bbe7a7948c1aac9feba4d2505cdd95d65167adea)
  • 18c5d70088 refactor: build the basepoints only on the call that loads them `cmz_group_init` built a `CMZBasepoints` and handed it to `load_bp`, which then dropped it on the floor unless the map was empty -- and `load_bp` cloned it when it was not. Callers invoke this on every request, so take a closure and construct only on the call that actually populates the map. By itself that is a shape fix, not a measured win: `wnaf_is_constant_time` is not a default feature and nothing enables it, so `CMZBasepoints` is `{A_, B_}` and construction plus clone costs about 8ns. It matters under that feature, where construction is two WnafBase tables. The cost callers actually pay is the argument, not the call: `cmz_group_init(G::hash_from_bytes::<Sha512>(...))` evaluates the hash-to-curve eagerly, at roughly 4.7us per request, and nothing on the callee side can reach it. So `cmz_group_init_with` takes the generator as a closure too, and the hash happens once, on the call that initializes. Both sides of a round trip call this, so it is roughly 9us a round trip for a one-word change at each call site. `cmz_group_init` is unchanged. (cherry picked from commit 0b8a6fbbb7f06aa68d6a00c60efdfe555e9ac528)
  • ee6d70590e fix: key the basepoints map on the group type `StaticTypeMap::call_once::<Type, _>` looks the entry up by `TypeId::of::<Type>()`, and this passed `Box<dyn CMZbp>` -- the same type for every group. So the map held one slot shared by all groups rather than one per group, which is the whole point of the design described at length above it: a second `cmz_group_init` for a different group was ignored, and the following `cmz_basepoints` read back the first group's basepoints and panicked in the downcast. Key on `G` instead. This makes previously-panicking programs work, so it is a behaviour change and kept apart from the refactor that follows it. tests/two_groups.rs covers it, and needs a second curve: cmz had only curve25519-dalek available, so p256 joins the dev-dependencies. (cherry picked from commit 25aa8f25cfeb28e995665eba3d946287b841742d)
  • c631866f89 Update sigma-compiler and dependencies to mu/draft-v3
  • 97930666d4 Update version to 0.3.0 Depend on sigma-compiler 0.2.3

1 месяц назад

orru создал новую ветку mu/draft-v3-2 в SigmaProtocol/cmz

1 месяц назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/cmz

  • 4861abd581 test: derive rate-limit epoch bases with RFC 9380
  • c3a5b0fe18 feat!: derive CMZ generator A automatically Derive and memoize the auxiliary generator with RFC 9380 hash-to-group, while retaining explicit initialization as a pre-first-use compatibility override. BREAKING CHANGE: CMZ credential point types must implement the encoding and SHA-512 hash-to-group bounds captured by CMZGroup.
  • 1ab9c869ab chore: patch sigma-compiler, sigma-proofs and spongefish to their mu/draft-v3 branches
  • cc3eba13dc test: issue the credential before showing it
  • aac154912b fix: omit the client proof when the statement has no content
  • Просмотр сравнение для этих 11 коммитов »

2 месяцев назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/sigma-compiler

  • f783ddb367 chore: patch sigma-proofs and spongefish to their mu/draft-v3 branches
  • c70bf20df3 feat: automatically reuse the canonical group generator
  • 8dce96b838 feat: emit public-scalar claims under disjunctions as constant-shape claim branches
  • 998e45dee5 fix: port the code generator to the sigma-proofs draft API
  • c1c1ed28e1 Update version to 0.2.3 Depend on sigma-proofs 0.3.2

3 месяцев назад

orru создал новую ветку mu/draft-v3 в SigmaProtocol/sigma-compiler

3 месяцев назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/cmz

  • 265b4478b6 chore: patch sigma-compiler, sigma-proofs and spongefish to their mu/draft-v3 branches
  • 0d8eecf2e7 fix: omit the client proof when the statement has no content
  • 5ac5c724ce chore: patch sigma-compiler, sigma-proofs and spongefish to their mu/draft-v3 branches
  • 8a7d44d201 fix: omit the client proof when the statement has no content
  • d9752fdad1 feat: share the issuer pubkey element between show and issue scopes The issuer public key component for a given (credential type, attribute) is one value, but the show scope and the issue scope mint separate identifiers for it (`X_show_Hattr_*` and `X_iss_Hattr_*`), so a protocol that shows and issues the same credential type carried it twice -- two compressions and two 32-byte encodings per relation, for one value. The first scope to declare it now owns the element and later ones are tagged `dedup`, sharing it whenever the values agree at run time. They need not: `handle_update` gives the shown credential the caller's old public key and the issued one the server's current key, so a rotation makes them genuinely different, and then each simply keeps its own element. For a three-attribute credential shown and reissued, this is three elements per client relation, on both sides. Requires the `dedup` tag from sigma-compiler, and changes the encoded instance, hence the challenge: prover and verifier must be upgraded together.
  • Просмотр сравнение для этих 6 коммитов »

3 месяцев назад

orru запушил(а) mu/draft-v3 в SigmaProtocol/cmz

  • 5ac5c724ce chore: patch sigma-compiler, sigma-proofs and spongefish to their mu/draft-v3 branches
  • 8a7d44d201 fix: omit the client proof when the statement has no content
  • d9752fdad1 feat: share the issuer pubkey element between show and issue scopes The issuer public key component for a given (credential type, attribute) is one value, but the show scope and the issue scope mint separate identifiers for it (`X_show_Hattr_*` and `X_iss_Hattr_*`), so a protocol that shows and issues the same credential type carried it twice -- two compressions and two 32-byte encodings per relation, for one value. The first scope to declare it now owns the element and later ones are tagged `dedup`, sharing it whenever the values agree at run time. They need not: `handle_update` gives the shown credential the caller's old public key and the issued one the server's current key, so a rotation makes them genuinely different, and then each simply keeps its own element. For a three-attribute credential shown and reissued, this is three elements per client relation, on both sides. Requires the `dedup` tag from sigma-compiler, and changes the encoded instance, hence the challenge: prover and verifier must be upgraded together.
  • 09fd602c41 feat: declare B_generator as the group generator sigma-proofs reserves element index 0 of every instance for `G::generator()`, which it validates but never serializes. `B_generator` *is* `G::generator()` (`CMZBasepoints::init` sets it so), but it was allocated an ordinary element, so every relation cmz emits paid a point compression and 32 bytes of instance encoding for it -- on every prove and every verify, while the reserved slot sat unused. Declare it `generator` and it lands on index 0 instead. It keeps `cind`: the range-proof transform takes the first two `cind` points, sorted, as its Pedersen bases, and those are `A_generator` and `B_generator`. It stays an `Instance` field, deliberately. The generated code still assigns it, and `LinearRelation::set_element` rejects an assignment that conflicts with the generator already at index 0 -- so if `B_generator` ever stops being the generator, it fails loudly instead of silently proving a different statement. Requires the `generator` tag from sigma-compiler, and changes the encoded instance, hence the challenge: prover and verifier must be upgraded together.
  • db5a2b8552 refactor: build the basepoints only on the call that loads them `cmz_group_init` built a `CMZBasepoints` and handed it to `load_bp`, which then dropped it on the floor unless the map was empty -- and `load_bp` cloned it when it was not. Callers invoke this on every request, so take a closure and construct only on the call that actually populates the map. By itself that is a shape fix, not a measured win: `wnaf_is_constant_time` is not a default feature and nothing enables it, so `CMZBasepoints` is `{A_, B_}` and construction plus clone costs about 8ns. It matters under that feature, where construction is two WnafBase tables. The cost callers actually pay is the argument, not the call: `cmz_group_init(G::hash_from_bytes::<Sha512>(...))` evaluates the hash-to-curve eagerly, at roughly 4.7us per request, and nothing on the callee side can reach it. So `cmz_group_init_with` takes the generator as a closure too, and the hash happens once, on the call that initializes. Both sides of a round trip call this, so it is roughly 9us a round trip for a one-word change at each call site. `cmz_group_init` is unchanged.

3 месяцев назад

orru создал новую ветку mu/draft-v3 в SigmaProtocol/cmz

3 месяцев назад

orru запушил(а) mu/versions в SigmaProtocol/cmz

7 месяцев назад

orru запушил(а) mu/serialization-cleanup в SigmaProtocol/sigma-compiler

  • 77dcc35d47 chore: cargo update and bump revision version
  • 45de450cff chore(core): stop using deprecated serialization from sigma-proofs
  • d4ffcd3a3d Update version to 0.2.0 Depend on the now-published sigma-proofs 0.2.0
  • c273ad1770 Use prove_compact and verify_compact now that they're supported by sigma-proofs
  • adf7102ec6 Add support for THRESH

7 месяцев назад