forked from hyperledger/fabric
-
Notifications
You must be signed in to change notification settings - Fork 1
/
issuerkey.go
161 lines (131 loc) · 4.73 KB
/
issuerkey.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
/*
Copyright IBM Corp. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
*/
package idemix
import (
"github.com/golang/protobuf/proto"
"github.com/hyperledger/fabric-amcl/amcl"
"github.com/hyperledger/fabric-amcl/amcl/FP256BN"
"github.com/pkg/errors"
)
// The Issuer secret ISk and public IPk keys are used to issue credentials and
// to verify signatures created using the credentials
// The Issuer Secret Key is a random exponent (generated randomly from Z*_p)
// The Issuer Public Key consists of several elliptic curve points (ECP),
// where index 1 corresponds to group G1 and 2 to group G2)
// HSk, HRand, BarG1, BarG2, an ECP array HAttrs, and an ECP2 W,
// and a proof of knowledge of the corresponding secret key
// NewIssuerKey creates a new issuer key pair taking an array of attribute names
// that will be contained in credentials certified by this issuer (a credential specification)
func NewIssuerKey(AttributeNames []string, rng *amcl.RAND) (*IssuerKey, error) {
attributeNamesMap := map[string]bool{}
for _, name := range AttributeNames {
if attributeNamesMap[name] {
return nil, errors.Errorf("attribute %s appears multiple times in AttributeNames", name)
}
attributeNamesMap[name] = true
}
key := new(IssuerKey)
// generate issuer secret key
ISk := RandModOrder(rng)
key.Isk = BigToBytes(ISk)
// generate the corresponding public key
key.Ipk = new(IssuerPublicKey)
key.Ipk.AttributeNames = AttributeNames
W := GenG2.Mul(ISk)
key.Ipk.W = Ecp2ToProto(W)
// generate bases that correspond to the attributes
key.Ipk.HAttrs = make([]*ECP, len(AttributeNames))
for i := 0; i < len(AttributeNames); i++ {
key.Ipk.HAttrs[i] = EcpToProto(GenG1.Mul(RandModOrder(rng)))
}
HSk := GenG1.Mul(RandModOrder(rng))
key.Ipk.HSk = EcpToProto(HSk)
HRand := GenG1.Mul(RandModOrder(rng))
key.Ipk.HRand = EcpToProto(HRand)
BarG1 := GenG1.Mul(RandModOrder(rng))
key.Ipk.BarG1 = EcpToProto(BarG1)
BarG2 := BarG1.Mul(ISk)
key.Ipk.BarG2 = EcpToProto(BarG2)
// generate a zero-knowledge proof of knowledge (ZK PoK) of the secret key
r := RandModOrder(rng)
t1 := GenG2.Mul(r)
t2 := BarG1.Mul(r)
proofData := make([]byte, 18*FieldBytes+3)
index := 0
index = appendBytesG2(proofData, index, t1)
index = appendBytesG1(proofData, index, t2)
index = appendBytesG2(proofData, index, GenG2)
index = appendBytesG1(proofData, index, BarG1)
index = appendBytesG2(proofData, index, W)
index = appendBytesG1(proofData, index, BarG2)
proofC := HashModOrder(proofData)
key.Ipk.ProofC = BigToBytes(proofC)
proofS := Modadd(FP256BN.Modmul(proofC, ISk, GroupOrder), r, GroupOrder)
key.Ipk.ProofS = BigToBytes(proofS)
serializedIPk, err := proto.Marshal(key.Ipk)
if err != nil {
return nil, errors.Wrap(err, "failed to marshal issuer public key")
}
key.Ipk.Hash = BigToBytes(HashModOrder(serializedIPk))
return key, nil
}
// Check checks that this issuer public key is valid, i.e.
// that all components are present and a ZK proofs verifies
func (IPk *IssuerPublicKey) Check() error {
NumAttrs := len(IPk.GetAttributeNames())
HSk := EcpFromProto(IPk.GetHSk())
HRand := EcpFromProto(IPk.GetHRand())
HAttrs := make([]*FP256BN.ECP, len(IPk.GetHAttrs()))
for i := 0; i < len(IPk.GetHAttrs()); i++ {
HAttrs[i] = EcpFromProto(IPk.GetHAttrs()[i])
}
BarG1 := EcpFromProto(IPk.GetBarG1())
BarG2 := EcpFromProto(IPk.GetBarG2())
W := Ecp2FromProto(IPk.GetW())
ProofC := FP256BN.FromBytes(IPk.GetProofC())
ProofS := FP256BN.FromBytes(IPk.GetProofS())
if NumAttrs < 0 ||
HSk == nil ||
HRand == nil ||
BarG1 == nil ||
BarG1.Is_infinity() ||
BarG2 == nil ||
HAttrs == nil ||
len(IPk.HAttrs) < NumAttrs {
return errors.Errorf("some part of the public key is undefined")
}
for i := 0; i < NumAttrs; i++ {
if IPk.HAttrs[i] == nil {
return errors.Errorf("some part of the public key is undefined")
}
}
// Check Proof
proofData := make([]byte, 18*FieldBytes+3)
index := 0
t1 := GenG2.Mul(ProofS)
t1.Add(W.Mul(FP256BN.Modneg(ProofC, GroupOrder)))
t2 := BarG1.Mul(ProofS)
t2.Add(BarG2.Mul(FP256BN.Modneg(ProofC, GroupOrder)))
index = appendBytesG2(proofData, index, t1)
index = appendBytesG1(proofData, index, t2)
index = appendBytesG2(proofData, index, GenG2)
index = appendBytesG1(proofData, index, BarG1)
index = appendBytesG2(proofData, index, W)
index = appendBytesG1(proofData, index, BarG2)
if *ProofC != *HashModOrder(proofData) {
return errors.Errorf("zero knowledge proof in public key invalid")
}
return IPk.SetHash()
}
// SetHash appends a hash of a serialized public key
func (IPk *IssuerPublicKey) SetHash() error {
IPk.Hash = nil
serializedIPk, err := proto.Marshal(IPk)
if err != nil {
return errors.Wrap(err, "Failed to marshal issuer public key")
}
IPk.Hash = BigToBytes(HashModOrder(serializedIPk))
return nil
}