New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Another modification to RNG generation to be both constant time, secure, and easy to implement as a circuit. #311
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Love it. The use of shifting is especially slick 🤘💯
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Beautiful -- thanks for the clear explanation in the comment!
// Normally, we would use rejection sampling here, but our specialized | ||
// verifier circuit really wants an O(1) solution to sampling. So instead, we | ||
// sample [0, 2^192) % P. This is very close to uniform, as we have 2^192 / P | ||
// full copies of P, with only 2^192%P left over elements in the 'partial' copy |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// full copies of P, with only 2^192%P left over elements in the 'partial' copy | |
// full copies of P, with only `2 ^ 192 % P` left over elements in the 'partial' copy |
// Even if we imagined that this failure to reject totally destroys soundess, | ||
// the probablity of it occuring even once during proving is vanishingly low | ||
// (for the about 50 samples our current verifier pulls and at a probability of | ||
// less than2^-161 per sample, this is less than 2^-155). Even if we target |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// less than2^-161 per sample, this is less than 2^-155). Even if we target | |
// less than `2 ^ -161` per sample, this is less than `2 ^ -155`). Even if we target |
No description provided.