[AIP-20] Generic Operations of Algebraic Structures #86

zjma · 2023-03-15T20:15:32Z

No description provided.

davidiw

This seems fine, my major concern is how do we validate this for correctness and completeness. The section on ### Implementation of BLS12-381 structures is very verbose with statements like /// NOTE: currently information-only and no operations are implemented for this structure. Can we make this more succinct?

zjma · 2023-03-20T23:18:38Z

This seems fine, my major concern is how do we validate this for correctness and completeness.

@davidiw if your concern is on the dependencies, arkworks cryptography libraries are widely adopted (stats), and to our knowledge is our best option in terms of correct & complete implementation. Wonder if additional auditing is still needed.

zjma · 2023-03-23T23:15:28Z

Can we make this more succinct?

Should be fixed now.

wrwg · 2023-04-05T03:18:55Z

aips/aip-20.md

+Below is the full specification in pseudo-Move.
+
+```rust
+module aptos_std::algebra {


Can we give this a more specific name than 'algebra'? It sounds weird for some one with math background, because there are many different algebras, and they would be named according to what they do. It could be crypt_algebra, or whatever is adequate for this particular instance here.

wrwg · 2023-04-05T03:25:07Z

aips/aip-20.md

+
+```rust
+module aptos_std::algebra_bls12381 {
+    /// The finite field $F_q$ used in BLS12-381 curves.


It's intended latex. I also rewrote the bls12381 section so those equations can render.

wrwg · 2023-04-05T03:25:24Z

aips/aip-20.md

+
+The construction of BLS12-381 curves involve many groups/fields, some frequently interacted by applications (e.g., `Fq12`, `Fr`, `G1Affine`, `G2Affine`, `Gt`) while others rarely used. Marker types for using these structures with `aptos_std::algebra` APIs should be defined and exposed to developers, along with their widely-used serialization formats and hash-to-group suites, (ideally in its own module named `aptos_std::algebra_bls12381`).
+
+Below are the full specification in pseudo-Move.


'Below is the...'

rewrote the bls12381 section

alinush · 2023-04-13T18:56:27Z

aips/aip-20.md

+
+## Rationale
+
+An alternative non-generic approach is to expose instantiated schemes directly in stdlib.


Typo: in aptos_stdlib

Thanks for the extra pass! Fixed.

alinush · 2023-04-13T18:57:37Z

aips/aip-20.md

+An alternative non-generic approach is to expose instantiated schemes directly in stdlib.
+For example, we can define a Groth16 proof verification function
+`0x1::groth16_b::verify_proof(vk, proof, public_inputs): bool`
+for every bilinear map `b`;


Editorial suggestion: replace ';' by a dot. Move "for ECDSA" as a "For ECDSA" new paragraph.

Editorial suggestion 2: Replace b by <curve> and say "for every pairing-friendly elliptic curve <curve>"

Or maybe <group>

alinush · 2023-04-13T18:59:23Z

aips/aip-20.md

+For example, we can define a Groth16 proof verification function
+`0x1::groth16_b::verify_proof(vk, proof, public_inputs): bool`
+for every bilinear map `b`;
+for ECDSA signatures which requires a hash function and a group, we can define


Typo: , which require**,** (remove 's')

alinush · 2023-04-13T18:59:46Z

aips/aip-20.md

+for every bilinear map `b`;
+for ECDSA signatures which requires a hash function and a group, we can define
+`0x1::ecdsa_h_g::verify_signature(pk, msg, sig):bool`
+for each pair of proper hash function `h` and group `g`.


same suggestion as above: <hash> and <group>

alinush · 2023-04-13T19:01:25Z

aips/aip-20.md

+`0x1::ecdsa_h_g::verify_signature(pk, msg, sig):bool`
+for each pair of proper hash function `h` and group `g`.
+
+Compared with the proposed approach, the alternative approach saves the work of constructing the schemes for Move developers. However, the size of stdlib can multiply too fast in the future.


aptos_stdlib

"Furthermore, the non-generic approach is not scalable from a development standpoint: a new native is needed for every combination of cryptosystem and its underlying algebraic structure (e.g., elliptic curve)"

alinush · 2023-04-13T19:02:08Z

aips/aip-20.md

+
+In general, every structure implements basic operations like (de)serialization, equality check, random sampling.
+
+A group may also implement the following operations. (Additive notions are used.)


Editorial: "For example, a group may [...]

alinush · 2023-04-13T19:02:21Z

aips/aip-20.md

+- `multi_scalar_mul()` for efficient group multi-scalar multiplication.
+- `hash_to()` for hash-to-group.
+
+A field may also implement the following operations.


Editorial: "As another example, a field may [...]

alinush · 2023-04-13T19:03:59Z

aips/aip-20.md

+- `sqr()` for efficient field element squaring.
+- `from_u64()` for quick conversion from u64 to field element.
+
+For 3 groups that form a bilinear map, `pairing()` and `multi_pairing()` may be implemented.


Editorial: "Similarly, for 3 groups G1, G2, GT that admit a bilinear map [...], pairing<G1, G2, GT>() and [...]."

alinush · 2023-04-13T19:04:59Z

aips/aip-20.md

+
+For 3 groups that form a bilinear map, `pairing()` and `multi_pairing()` may be implemented.
+
+For a subset/superset relationship between 2 structures, `upcast()` and `downcast()` may be implemented.


Give examples here (e.g., the BLS12-381 use cases)

alinush · 2023-04-13T19:05:13Z

aips/aip-20.md

+#### Shared Scalar Fields
+
+Some groups share the same group order,
+and an ergonomic design from this is to


Typo: for this

alinush · 2023-04-13T19:05:29Z

aips/aip-20.md

+Some groups share the same group order,
+and an ergonomic design from this is to
+allow multiple groups to share the same scalar field
+(mainly for the purpose scalar multiplication),


Typo: for the purpose of

alinush · 2023-04-13T19:05:57Z

aips/aip-20.md

+(mainly for the purpose scalar multiplication),
+if they have the same order.
+
+E.g. the following should be supported.


Editorial: "In other words, the following [...]"

alinush · 2023-04-13T20:09:56Z

aips/aip-20.md

+#### Handling Incorrect Type Parameter(s)
+
+There is currently no easy way to ensure type safety for the generic operations.
+E.g., `pairing<A,B,C>(a,b,c)` can compile even there is no pairing between `A,B,C` existing/implemented.


Typo: even if groups A, B and C do not admit a pairing

alinush · 2023-04-13T20:10:18Z

aips/aip-20.md

+There is currently no easy way to ensure type safety for the generic operations.
+E.g., `pairing<A,B,C>(a,b,c)` can compile even there is no pairing between `A,B,C` existing/implemented.
+
+Therefore the backend should handle the type checks at runtime.


Typo: Therefore**,** the backend must handle [...]

alinush · 2023-04-13T20:10:41Z

aips/aip-20.md

+
+Therefore the backend should handle the type checks at runtime.
+
+If a group operations that takes 2+ type parameters is invoked with incompatible type parameters, it should abort.


operation (singular)

Editorial: remove paragraph, and start sentence with "For example, [...]"

it must abort.

alinush · 2023-04-13T20:13:11Z

aips/aip-20.md

+Therefore the backend should handle the type checks at runtime.
+
+If a group operations that takes 2+ type parameters is invoked with incompatible type parameters, it should abort.
+E.g. `scalar_mul<GroupA, ScalarForBx>()` should abort with a “not implemented” error.


I would write this more clearly as:

For example, scalar_mul<GroupA, ScalarB>(), where GroupA and ScalarB have different orders, will abort with a “not implemented” error.

alinush · 2023-04-13T20:15:42Z

aips/aip-20.md

+If a group operations that takes 2+ type parameters is invoked with incompatible type parameters, it should abort.
+E.g. `scalar_mul<GroupA, ScalarForBx>()` should abort with a “not implemented” error.
+
+Invoking operation functions with user-defined types should also abort with a “not implemented” error.


Add: "For example, zero<std::option::Option<u64>>() will abort."

alinush · 2023-04-13T20:28:18Z

aips/aip-20.md

+
+### Implementation of BLS12-381 structures
+
+To support all potential BLS12-381 operations using the `aptos_std::crypto_algebra` API,


Editorial suggestion to replace these two paragraphs by:

To support a wide-enough variety of BLS12-381 operations using the aptos_std::crypto_algebra API,
we implement several marker types for the relevant groups of order $r$ (for $\mathbb{G}_1$, $\mathbb{G}_2$ and $\mathbb{G}_T$) and fields (e.g, $\mathbb{F}_r$, $\mathbb{F}_q$, $\mathbb{F}_{q^{12}}$)

We also implement marker types for popular serialization formats and hash-to-group suites.

Below, we describe all possible marker types we could implement for BLS12-381 and mark the ones that we actually implement as "implemented".
These, we believe, should be sufficient to support most BLS12-381 applications.

alinush · 2023-04-13T20:44:54Z

aips/aip-20.md

+
+## Risks and Drawbacks
+
+For move application developers, constructing cryptographic schemes manually with these building blocks can be error-prone, or even result in vulnerable applications.


Editorial suggestion: Replace this with the following paragraph:

Developing cryptographic schemes, whether in Move or in any other language, is very difficult due to the inherent mathematic complexity of such schemes, as well as the difficulty of using cryptographic libraries securely.

As a result, we caution Move application developers that implementing cryptographic schemes using the crypto_algebra.move and/or the bls12381_algebra.move modules will be error prone and could result in vulnerable applications.

That being said, the crypto_algebra.move and the bls12381_algebra.move Move modules have been designed with safety in mind.
First, we offer a minimal, hard-to-misuse abstraction for algebraic structures like groups and fields.
Second, our Move modules are type safe (e.g., inversion in a group G returns an Option<G>).
Third, our BLS12-381 implementation always performs prime-order subgroup checks when deserializing group elements, to avoid serious implementation bugs.

alinush · 2023-04-13T20:47:47Z

aips/aip-20.md

+
+## Future Potential
+
+The module can be extended to support more structures and operations, allowing more complicated cryptographic applications to be built.


Editorial: The crypto_algebra.move Move module can be extended to support more structures (e.g., new elliptic curves) and operations (e.g., batch inversion of field elements). This will:

Allow porting existing generic cryptosystems built on top of this module to new, potentially-faster-or-smaller curves.

Allow building more complicated cryptographic applications that leverage new operations or new algebraic structures (e.g., rings, hidden-order groups, etc.)

alinush · 2023-04-13T20:48:41Z

aips/aip-20.md

+
+The module can be extended to support more structures and operations, allowing more complicated cryptographic applications to be built.
+
+Once Move interface is available, it can be use to rewrite the move side specifications to ensure type safety at compile time.


Editorial: Once the Move language is upgraded with support for some kind of interfaces, [...] rewrite the Move [...]

davidiw

I think the piece missing here is that this involves a form of dispatch between the Move language and adapter layer. This is rather exceptional and unusual behavior. Could we please add a brief description of that?

Maybe we can add that in the rationale... we have chosen ...

davidiw · 2023-04-14T05:40:33Z

well done

zjma added 6 commits February 1, 2023 15:26

generic prime-order groups AIP

b089504

temp rename

2eedeb1

Merge remote-tracking branch 'origin/main' into groups

0b1a548

update

545a385

update

0437f66

update

6ea2323

thepomeranian requested review from davidiw and movekevin March 15, 2023 20:22

update

26a30cd

davidiw reviewed Mar 19, 2023

View reviewed changes

zjma mentioned this pull request Mar 21, 2023

crypto_algebra.move aptos-labs/aptos-core#6550

Merged

11 tasks

zjma added 6 commits March 23, 2023 15:04

update

ad2e6c5

Merge remote-tracking branch 'origin/main' into groups

60de193

update

b5e78c5

whitespace fit

ba80b2d

doc update

bba322d

doc update

a6b3195

zjma mentioned this pull request Apr 1, 2023

[AIP-20][Discussion] Generic Cryptography Algebra and BLS12-381 Implementation #94

Closed

add discussion link

afa6971

thepomeranian self-requested a review April 3, 2023 17:07

thepomeranian approved these changes Apr 3, 2023

View reviewed changes

thepomeranian requested review from aching, wrwg, sherry-x and igor-aptos April 3, 2023 17:08

wrwg reviewed Apr 5, 2023

View reviewed changes

zjma added 2 commits April 5, 2023 07:46

rewrite section for bls12381 structures

edc553d

doc update

7b9613e

update title

09fbf56

alinush reviewed Apr 13, 2023

View reviewed changes

editorial fixes

68a3011

alinush reviewed Apr 13, 2023

View reviewed changes

zjma added 2 commits April 13, 2023 13:58

editorial fixes

41341b7

editorial fixes

5a0a283

davidiw reviewed Apr 14, 2023

View reviewed changes

dispatch framework

5342c01

davidiw approved these changes Apr 14, 2023

View reviewed changes

davidiw merged commit c43b3ee into aptos-foundation:main Apr 14, 2023


		The construction of BLS12-381 curves involve many groups/fields, some frequently interacted by applications (e.g., `Fq12`, `Fr`, `G1Affine`, `G2Affine`, `Gt`) while others rarely used. Marker types for using these structures with `aptos_std::algebra` APIs should be defined and exposed to developers, along with their widely-used serialization formats and hash-to-group suites, (ideally in its own module named `aptos_std::algebra_bls12381`).

		Below are the full specification in pseudo-Move.


		## Rationale

		An alternative non-generic approach is to expose instantiated schemes directly in stdlib.


		In general, every structure implements basic operations like (de)serialization, equality check, random sampling.

		A group may also implement the following operations. (Additive notions are used.)


		For 3 groups that form a bilinear map, `pairing()` and `multi_pairing()` may be implemented.

		For a subset/superset relationship between 2 structures, `upcast()` and `downcast()` may be implemented.


		Therefore the backend should handle the type checks at runtime.

		If a group operations that takes 2+ type parameters is invoked with incompatible type parameters, it should abort.


		### Implementation of BLS12-381 structures

		To support all potential BLS12-381 operations using the `aptos_std::crypto_algebra` API,


		## Risks and Drawbacks

		For move application developers, constructing cryptographic schemes manually with these building blocks can be error-prone, or even result in vulnerable applications.


		## Future Potential

		The module can be extended to support more structures and operations, allowing more complicated cryptographic applications to be built.


		The module can be extended to support more structures and operations, allowing more complicated cryptographic applications to be built.

		Once Move interface is available, it can be use to rewrite the move side specifications to ensure type safety at compile time.

[AIP-20] Generic Operations of Algebraic Structures #86

[AIP-20] Generic Operations of Algebraic Structures #86

Conversation

zjma commented Mar 15, 2023

davidiw left a comment

Choose a reason for hiding this comment

zjma commented Mar 20, 2023

zjma commented Mar 23, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alinush Apr 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alinush Apr 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alinush Apr 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alinush Apr 13, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

davidiw left a comment

Choose a reason for hiding this comment

davidiw commented Apr 14, 2023

alinush Apr 13, 2023 •

edited

alinush Apr 13, 2023 •

edited

alinush Apr 13, 2023 •

edited

alinush Apr 13, 2023 •

edited