每个 Sigma 协议还定义了其 ChallengeLength 作为关联类型。

使用这些算法，交互式 Sigma 协议的执行过程如下

Prover(witness, statement, rng)                                                 Verifier(statement)
======
announce_secret = gen_announce_secret(rng)
announcement = announce(statement, announce_secret)
                                                      announcement
                                                  +------------------->
                                                       challenge         *uniformly sample ChallengeLength bytes*
                                                  <-------------------+
response = respond(witness, statement,
                   announce_secret, announcement,
                   challenge)

                                                       response
                                                  +------------------->
                                                                                            check
                                                                        implied_announcement(statement, challenge, response)
                                                                                              ==
                                                                                         announcement

非交互式证明

使 Sigma 协议非交互式的一种标准技巧是从哈希函数中生成上图中的 challenge。这被称为 Fiat-Shamir 启发式，在 随机预言机模型 中是安全的。验证者只需检查哈希是否正确计算以及响应是否正确。

示例

佩德森承诺的形式为 C = r * G + c * H，其中 c 是对 h 的一个值所做的承诺，且 H = h * G 对承诺者来说是未知的。关于佩德森承诺的背景，请参阅 Shoenmaker 第 3.2.2 节。假设我们想向只知道 C 的人证明 c 要么为 0 要么为 1，我们可以通过展示我们知道 r 使得 C = r * G 或 C - H = r * G 来构造一个非交互式证明。

use std::string::ToString;
use sigma_fun::{ typenum::U16, FiatShamir, HashTranscript, Either, Or, secp256k1::{ self, fun::{Point, Scalar, G, marker::*, g}}};
use sha2::Sha256;
use rand_chacha::ChaCha20Rng;

// Pretend to choose H securely in a public setup
let H = Point::random(&mut rand::thread_rng());
// our commitment will be to 1
let c = Scalar::<Secret, _>::from(1u32);
// We use a 16-byte (128-bit) challenge length
type L = U16;

let (C,r) = {
    // make a pedersen commitment
    let r = Scalar::random(&mut rand::thread_rng());
    let C = g!(r * G + c * H).normalize().non_zero().expect("zero is computationally unreachable");
    (C,r)
};

// Our strategy is to prove that we know r such that either C = r * G or C - H = r * G using
// an OR composition between two standard knowledge of discrete logarithm proofs.
let statement = (C, g!(C - H).normalize().non_zero().expect("computationally unreachable"));
// since we are commiting to 1 we know the witness for the right hand side statement.
let witness =  Either::Right(r);

// Our prover is going to prove knowledge of one of two point to the base G (either C or C - H).
type Protocol = Or::<secp256k1::DLG<L>, secp256k1::DLG<L>>;

// Every protocol has an unambiguous name which is hashed into the transcript for protocol separation purposes.
assert_eq!(Protocol::default().to_string(), "or(DLG(secp256k1),DLG(secp256k1))");
// we want a non-interactive proof system so we apply the Fiat-Shamir transform with Sha256 as the challenge hash.
// We use ChaCha20Rng to help produce our announcement.
let proof_system  = FiatShamir::<Protocol, HashTranscript<Sha256, ChaCha20Rng>>::default();

// Make the non-interactive proof -- pass in a system rng to make the proof more robust.
let proof = proof_system.prove(&witness, &statement, Some(&mut rand::thread_rng()));

// The verifier gets sent (C, proof)
{
    // The verifier's proof system doesn't need the rng
    let proof_system = FiatShamir::<Protocol, HashTranscript<Sha256>>::default();
    // They recreate the statement
    let statement = (C, g!(C - H).normalize().non_zero().expect("bogus commitment"));
    // and verify it against the proof
    assert!(proof_system.verify(&statement, &proof));
    // The verifier is convinced of the statement and nothing else
}

功能标志

• ed25519：启用 ed25519 离散对数证明
• secp256k1：启用 secp256k1 离散对数证明（使用 [secp256kfun]）

另请参阅

• ZKP — 该库受到该库的启发，并且发展得更好。 zkp 对散列函数（sha3）和群（ristretto）有看法，并且只支持 eq 和 and 类型组合。