Hush Full Node software. We were censored from Github, this is where all development happens now.
https://hush.is
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
702 lines
22 KiB
702 lines
22 KiB
#include <gtest/gtest.h>
|
|
#include "zcash/Proof.hpp"
|
|
|
|
#include <iostream>
|
|
|
|
#include <libsnark/common/default_types/r1cs_ppzksnark_pp.hpp>
|
|
#include <libsnark/relations/constraint_satisfaction_problems/r1cs/examples/r1cs_examples.hpp>
|
|
#include <libsnark/zk_proof_systems/ppzksnark/r1cs_ppzksnark/r1cs_ppzksnark.hpp>
|
|
|
|
using namespace libzcash;
|
|
|
|
typedef libsnark::default_r1cs_ppzksnark_pp curve_pp;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::G1_type curve_G1;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::G2_type curve_G2;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::GT_type curve_GT;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::Fp_type curve_Fr;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::Fq_type curve_Fq;
|
|
typedef libsnark::default_r1cs_ppzksnark_pp::Fqe_type curve_Fq2;
|
|
|
|
#include "streams.h"
|
|
#include "version.h"
|
|
#include "utilstrencodings.h"
|
|
|
|
TEST(proofs, g1_pairing_at_infinity)
|
|
{
|
|
for (size_t i = 0; i < 100; i++) {
|
|
auto r1 = curve_G1::random_element();
|
|
auto r2 = curve_G2::random_element();
|
|
ASSERT_TRUE(
|
|
curve_pp::reduced_pairing(curve_G1::zero(), r2) ==
|
|
curve_GT::one()
|
|
);
|
|
ASSERT_TRUE(
|
|
curve_pp::final_exponentiation(
|
|
curve_pp::double_miller_loop(
|
|
curve_pp::precompute_G1(curve_G1::zero()),
|
|
curve_pp::precompute_G2(r2),
|
|
curve_pp::precompute_G1(curve_G1::zero()),
|
|
curve_pp::precompute_G2(r2)
|
|
)
|
|
) ==
|
|
curve_GT::one()
|
|
);
|
|
ASSERT_TRUE(
|
|
curve_pp::final_exponentiation(
|
|
curve_pp::double_miller_loop(
|
|
curve_pp::precompute_G1(r1),
|
|
curve_pp::precompute_G2(r2),
|
|
curve_pp::precompute_G1(curve_G1::zero()),
|
|
curve_pp::precompute_G2(r2)
|
|
)
|
|
) ==
|
|
curve_pp::reduced_pairing(r1, r2)
|
|
);
|
|
ASSERT_TRUE(
|
|
curve_pp::final_exponentiation(
|
|
curve_pp::double_miller_loop(
|
|
curve_pp::precompute_G1(curve_G1::zero()),
|
|
curve_pp::precompute_G2(r2),
|
|
curve_pp::precompute_G1(r1),
|
|
curve_pp::precompute_G2(r2)
|
|
)
|
|
) ==
|
|
curve_pp::reduced_pairing(r1, r2)
|
|
);
|
|
}
|
|
}
|
|
|
|
TEST(proofs, g2_subgroup_check)
|
|
{
|
|
// all G2 elements are order r
|
|
ASSERT_TRUE(libsnark::alt_bn128_modulus_r * curve_G2::random_element() == curve_G2::zero());
|
|
|
|
// but that doesn't mean all elements that satisfy the curve equation are in G2...
|
|
curve_G2 p = curve_G2::one();
|
|
|
|
while (1) {
|
|
// This will construct an order r(2q-r) point with high probability
|
|
p.X = curve_Fq2::random_element();
|
|
try {
|
|
p.Y = ((p.X.squared() * p.X) + libsnark::alt_bn128_twist_coeff_b).sqrt();
|
|
break;
|
|
} catch(...) {}
|
|
}
|
|
|
|
ASSERT_TRUE(p.is_well_formed()); // it's on the curve
|
|
ASSERT_TRUE(libsnark::alt_bn128_modulus_r * p != curve_G2::zero()); // but not the order r subgroup..
|
|
|
|
{
|
|
// libsnark unfortunately doesn't check, and the pairing will complete
|
|
auto e = curve_Fr("149");
|
|
auto a = curve_pp::reduced_pairing(curve_G1::one(), p);
|
|
auto b = curve_pp::reduced_pairing(e * curve_G1::one(), p);
|
|
|
|
// though it will not preserve bilinearity
|
|
ASSERT_TRUE((a^e) != b);
|
|
}
|
|
|
|
{
|
|
// so, our decompression API should not allow you to decompress G2 elements of that form!
|
|
CompressedG2 badp(p);
|
|
try {
|
|
auto newp = badp.to_libsnark_g2<curve_G2>();
|
|
FAIL() << "Expected std::runtime_error";
|
|
} catch (std::runtime_error const & err) {
|
|
EXPECT_EQ(err.what(), std::string("point is not in G2"));
|
|
} catch(...) {
|
|
FAIL() << "Expected std::runtime_error";
|
|
}
|
|
}
|
|
|
|
// educational purposes: showing that E'(Fp2) is of order r(2q-r),
|
|
// by multiplying our random point in E' by (2q-r) = (q + q - r) to
|
|
// get an element in G2
|
|
{
|
|
auto p1 = libsnark::alt_bn128_modulus_q * p;
|
|
p1 = p1 + p1;
|
|
p1 = p1 - (libsnark::alt_bn128_modulus_r * p);
|
|
|
|
ASSERT_TRUE(p1.is_well_formed());
|
|
ASSERT_TRUE(libsnark::alt_bn128_modulus_r * p1 == curve_G2::zero());
|
|
|
|
CompressedG2 goodp(p1);
|
|
auto newp = goodp.to_libsnark_g2<curve_G2>();
|
|
|
|
ASSERT_TRUE(newp == p1);
|
|
}
|
|
}
|
|
|
|
TEST(proofs, sqrt_zero)
|
|
{
|
|
ASSERT_TRUE(curve_Fq::zero() == curve_Fq::zero().sqrt());
|
|
ASSERT_TRUE(curve_Fq2::zero() == curve_Fq2::zero().sqrt());
|
|
}
|
|
|
|
TEST(proofs, sqrt_fq)
|
|
{
|
|
// Poor man's PRNG
|
|
curve_Fq acc = curve_Fq("348957923485290374852379485") ^ 1000;
|
|
|
|
size_t quadratic_residues = 0;
|
|
size_t quadratic_nonresidues = 0;
|
|
|
|
for (size_t i = 1; i < 1000; i++) {
|
|
try {
|
|
acc += curve_Fq("45634563456") ^ i;
|
|
|
|
curve_Fq x = acc.sqrt();
|
|
ASSERT_TRUE((x*x) == acc);
|
|
quadratic_residues += 1;
|
|
} catch (std::runtime_error &e) {
|
|
quadratic_nonresidues += 1;
|
|
}
|
|
}
|
|
|
|
// Half of all nonzero elements in Fp are quadratic residues
|
|
ASSERT_TRUE(quadratic_residues == 511);
|
|
ASSERT_TRUE(quadratic_nonresidues == 488);
|
|
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_Fq x = curve_Fq::random_element();
|
|
curve_Fq x2 = x * x;
|
|
|
|
ASSERT_TRUE((x2.sqrt() == x) || (x2.sqrt() == -x));
|
|
}
|
|
|
|
// Test vectors
|
|
ASSERT_TRUE(
|
|
curve_Fq("5204065062716160319596273903996315000119019512886596366359652578430118331601")
|
|
==
|
|
curve_Fq("348579348568").sqrt()
|
|
);
|
|
ASSERT_THROW(curve_Fq("348579348569").sqrt(), std::runtime_error);
|
|
}
|
|
|
|
TEST(proofs, sqrt_fq2)
|
|
{
|
|
curve_Fq2 acc = curve_Fq2(
|
|
curve_Fq("3456293840592348059238409578239048769348760238476029347885092384059238459834") ^ 1000,
|
|
curve_Fq("2394578084760439457823945729347502374590283479582739485723945729384759823745") ^ 1000
|
|
);
|
|
|
|
size_t quadratic_residues = 0;
|
|
size_t quadratic_nonresidues = 0;
|
|
|
|
for (size_t i = 1; i < 1000; i++) {
|
|
try {
|
|
acc = acc + curve_Fq2(
|
|
curve_Fq("5204065062716160319596273903996315000119019512886596366359652578430118331601") ^ i,
|
|
curve_Fq("348957923485290374852379485348957923485290374852379485348957923485290374852") ^ i
|
|
);
|
|
|
|
curve_Fq2 x = acc.sqrt();
|
|
ASSERT_TRUE((x*x) == acc);
|
|
quadratic_residues += 1;
|
|
} catch (std::runtime_error &e) {
|
|
quadratic_nonresidues += 1;
|
|
}
|
|
}
|
|
|
|
// Half of all nonzero elements in Fp^k are quadratic residues as long
|
|
// as p != 2
|
|
ASSERT_TRUE(quadratic_residues == 505);
|
|
ASSERT_TRUE(quadratic_nonresidues == 494);
|
|
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_Fq2 x = curve_Fq2::random_element();
|
|
curve_Fq2 x2 = x * x;
|
|
|
|
ASSERT_TRUE((x2.sqrt() == x) || (x2.sqrt() == -x));
|
|
}
|
|
|
|
// Test vectors
|
|
ASSERT_THROW(curve_Fq2(
|
|
curve_Fq("2"),
|
|
curve_Fq("1")
|
|
).sqrt(), std::runtime_error);
|
|
|
|
ASSERT_THROW(curve_Fq2(
|
|
curve_Fq("3345897230485723946872934576923485762803457692345760237495682347502347589473"),
|
|
curve_Fq("1234912378405347958234756902345768290345762348957605678245967234857634857676")
|
|
).sqrt(), std::runtime_error);
|
|
|
|
curve_Fq2 x = curve_Fq2(
|
|
curve_Fq("12844195307879678418043983815760255909500142247603239203345049921980497041944"),
|
|
curve_Fq("7476417578426924565731404322659619974551724117137577781074613937423560117731")
|
|
);
|
|
|
|
curve_Fq2 nx = -x;
|
|
|
|
curve_Fq2 x2 = curve_Fq2(
|
|
curve_Fq("3345897230485723946872934576923485762803457692345760237495682347502347589474"),
|
|
curve_Fq("1234912378405347958234756902345768290345762348957605678245967234857634857676")
|
|
);
|
|
|
|
ASSERT_TRUE(x == x2.sqrt());
|
|
ASSERT_TRUE(nx == -x2.sqrt());
|
|
ASSERT_TRUE(x*x == x2);
|
|
ASSERT_TRUE(nx*nx == x2);
|
|
}
|
|
|
|
TEST(proofs, size_is_expected)
|
|
{
|
|
PHGRProof p;
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << p;
|
|
|
|
ASSERT_EQ(ss.size(), 296);
|
|
}
|
|
|
|
TEST(proofs, fq_serializes_properly)
|
|
{
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_Fq e = curve_Fq::random_element();
|
|
|
|
Fq e2(e);
|
|
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << e2;
|
|
|
|
Fq e3;
|
|
ss >> e3;
|
|
|
|
curve_Fq e4 = e3.to_libsnark_fq<curve_Fq>();
|
|
|
|
ASSERT_TRUE(e == e4);
|
|
}
|
|
}
|
|
|
|
TEST(proofs, fq2_serializes_properly)
|
|
{
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_Fq2 e = curve_Fq2::random_element();
|
|
|
|
Fq2 e2(e);
|
|
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << e2;
|
|
|
|
Fq2 e3;
|
|
ss >> e3;
|
|
|
|
curve_Fq2 e4 = e3.to_libsnark_fq2<curve_Fq2>();
|
|
|
|
ASSERT_TRUE(e == e4);
|
|
}
|
|
}
|
|
|
|
template<typename T>
|
|
T deserialize_tv(std::string s)
|
|
{
|
|
T e;
|
|
CDataStream ss(ParseHex(s), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> e;
|
|
|
|
return e;
|
|
}
|
|
|
|
curve_Fq deserialize_fq(std::string s)
|
|
{
|
|
return deserialize_tv<Fq>(s).to_libsnark_fq<curve_Fq>();
|
|
}
|
|
|
|
curve_Fq2 deserialize_fq2(std::string s)
|
|
{
|
|
return deserialize_tv<Fq2>(s).to_libsnark_fq2<curve_Fq2>();
|
|
}
|
|
|
|
TEST(proofs, fq_valid)
|
|
{
|
|
curve_Fq e = deserialize_fq("30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46");
|
|
|
|
ASSERT_TRUE(e == curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582"));
|
|
ASSERT_TRUE(e != curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208581"));
|
|
|
|
curve_Fq e2 = deserialize_fq("30644e72e131a029b75045b68181585d97816a916871ca8d3c208c16d87cfd46");
|
|
|
|
ASSERT_TRUE(e2 == curve_Fq("21888242871839275222221885816603420866962577604863418715751138068690288573766"));
|
|
}
|
|
|
|
TEST(proofs, fq_invalid)
|
|
{
|
|
// Should not be able to deserialize the modulus
|
|
ASSERT_THROW(
|
|
deserialize_fq("30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47"),
|
|
std::logic_error
|
|
);
|
|
|
|
// Should not be able to deserialize the modulus plus one
|
|
ASSERT_THROW(
|
|
deserialize_fq("30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd48"),
|
|
std::logic_error
|
|
);
|
|
|
|
// Should not be able to deserialize a ridiculously out of bound int
|
|
ASSERT_THROW(
|
|
deserialize_fq("ff644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46"),
|
|
std::logic_error
|
|
);
|
|
}
|
|
|
|
TEST(proofs, fq2_valid)
|
|
{
|
|
// (q - 1) * q + q
|
|
curve_Fq2 e = deserialize_fq2("0925c4b8763cbf9c599a6f7c0348d21cb00b85511637560626edfa5c34c6b38d04689e957a1242c84a50189c6d96cadca602072d09eac1013b5458a2275d69b0");
|
|
ASSERT_TRUE(e.c0 == curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582"));
|
|
ASSERT_TRUE(e.c1 == curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582"));
|
|
|
|
curve_Fq2 e2 = deserialize_fq2("000000000000000000000000000000000000000000000000010245be1c91e3186bbbe1c430a93fcfc5aada4ab10c3492f70eea97a91c7b29554db55acffa34d2");
|
|
ASSERT_TRUE(e2.c0 == curve_Fq("238769481237490823"));
|
|
ASSERT_TRUE(e2.c1 == curve_Fq("384579238459723485"));
|
|
|
|
curve_Fq2 e3 = deserialize_fq2("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000");
|
|
ASSERT_TRUE(e3.c0 == curve_Fq("0"));
|
|
ASSERT_TRUE(e3.c1 == curve_Fq("0"));
|
|
|
|
curve_Fq2 e4 = deserialize_fq2("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001");
|
|
ASSERT_TRUE(e4.c0 == curve_Fq("1"));
|
|
ASSERT_TRUE(e4.c1 == curve_Fq("0"));
|
|
}
|
|
|
|
TEST(proofs, fq2_invalid)
|
|
{
|
|
// (q - 1) * q + q is invalid
|
|
ASSERT_THROW(
|
|
deserialize_fq2("0925c4b8763cbf9c599a6f7c0348d21cb00b85511637560626edfa5c34c6b38d04689e957a1242c84a50189c6d96cadca602072d09eac1013b5458a2275d69b1"),
|
|
std::logic_error
|
|
);
|
|
|
|
// q * q + (q - 1) is invalid
|
|
ASSERT_THROW(
|
|
deserialize_fq2("0925c4b8763cbf9c599a6f7c0348d21cb00b85511637560626edfa5c34c6b38d34cced085b43e2f202a05e52ef18233a3d8371be725c8b8e7774e4b8ffda66f7"),
|
|
std::logic_error
|
|
);
|
|
|
|
// Ridiculously out of bounds
|
|
ASSERT_THROW(
|
|
deserialize_fq2("0fffc4b8763cbf9c599a6f7c0348d21cb00b85511637560626edfa5c34c6b38d04689e957a1242c84a50189c6d96cadca602072d09eac1013b5458a2275d69b0"),
|
|
std::logic_error
|
|
);
|
|
ASSERT_THROW(
|
|
deserialize_fq2("ffffffff763cbf9c599a6f7c0348d21cb00b85511637560626edfa5c34c6b38d04689e957a1242c84a50189c6d96cadca602072d09eac1013b5458a2275d69b0"),
|
|
std::logic_error
|
|
);
|
|
}
|
|
|
|
TEST(proofs, g1_serializes_properly)
|
|
{
|
|
// Cannot serialize zero
|
|
{
|
|
ASSERT_THROW({CompressedG1 g = CompressedG1(curve_G1::zero());}, std::domain_error);
|
|
}
|
|
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_G1 e = curve_G1::random_element();
|
|
|
|
CompressedG1 e2(e);
|
|
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << e2;
|
|
|
|
CompressedG1 e3;
|
|
ss >> e3;
|
|
|
|
ASSERT_TRUE(e2 == e3);
|
|
|
|
curve_G1 e4 = e3.to_libsnark_g1<curve_G1>();
|
|
|
|
ASSERT_TRUE(e == e4);
|
|
}
|
|
}
|
|
|
|
TEST(proofs, g2_serializes_properly)
|
|
{
|
|
// Cannot serialize zero
|
|
{
|
|
ASSERT_THROW({CompressedG2 g = CompressedG2(curve_G2::zero());}, std::domain_error);
|
|
}
|
|
|
|
for (size_t i = 0; i < 1000; i++) {
|
|
curve_G2 e = curve_G2::random_element();
|
|
|
|
CompressedG2 e2(e);
|
|
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << e2;
|
|
|
|
CompressedG2 e3;
|
|
ss >> e3;
|
|
|
|
ASSERT_TRUE(e2 == e3);
|
|
|
|
curve_G2 e4 = e3.to_libsnark_g2<curve_G2>();
|
|
|
|
ASSERT_TRUE(e == e4);
|
|
}
|
|
}
|
|
|
|
TEST(proofs, zksnark_serializes_properly)
|
|
{
|
|
auto example = libsnark::generate_r1cs_example_with_field_input<curve_Fr>(250, 4);
|
|
example.constraint_system.swap_AB_if_beneficial();
|
|
auto kp = libsnark::r1cs_ppzksnark_generator<curve_pp>(example.constraint_system);
|
|
auto vkprecomp = libsnark::r1cs_ppzksnark_verifier_process_vk(kp.vk);
|
|
|
|
for (size_t i = 0; i < 20; i++) {
|
|
auto badproof = PHGRProof::random_invalid();
|
|
auto proof = badproof.to_libsnark_proof<libsnark::r1cs_ppzksnark_proof<curve_pp>>();
|
|
|
|
auto verifierEnabled = ProofVerifier::Strict();
|
|
auto verifierDisabled = ProofVerifier::Disabled();
|
|
// This verifier should catch the bad proof
|
|
ASSERT_FALSE(verifierEnabled.check(
|
|
kp.vk,
|
|
vkprecomp,
|
|
example.primary_input,
|
|
proof
|
|
));
|
|
// This verifier won't!
|
|
ASSERT_TRUE(verifierDisabled.check(
|
|
kp.vk,
|
|
vkprecomp,
|
|
example.primary_input,
|
|
proof
|
|
));
|
|
}
|
|
|
|
for (size_t i = 0; i < 20; i++) {
|
|
auto proof = libsnark::r1cs_ppzksnark_prover<curve_pp>(
|
|
kp.pk,
|
|
example.primary_input,
|
|
example.auxiliary_input,
|
|
example.constraint_system
|
|
);
|
|
|
|
{
|
|
auto verifierEnabled = ProofVerifier::Strict();
|
|
auto verifierDisabled = ProofVerifier::Disabled();
|
|
ASSERT_TRUE(verifierEnabled.check(
|
|
kp.vk,
|
|
vkprecomp,
|
|
example.primary_input,
|
|
proof
|
|
));
|
|
ASSERT_TRUE(verifierDisabled.check(
|
|
kp.vk,
|
|
vkprecomp,
|
|
example.primary_input,
|
|
proof
|
|
));
|
|
}
|
|
|
|
ASSERT_TRUE(libsnark::r1cs_ppzksnark_verifier_strong_IC<curve_pp>(
|
|
kp.vk,
|
|
example.primary_input,
|
|
proof
|
|
));
|
|
|
|
PHGRProof compressed_proof_0(proof);
|
|
|
|
CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << compressed_proof_0;
|
|
|
|
PHGRProof compressed_proof_1;
|
|
ss >> compressed_proof_1;
|
|
|
|
ASSERT_TRUE(compressed_proof_0 == compressed_proof_1);
|
|
|
|
auto newproof = compressed_proof_1.to_libsnark_proof<libsnark::r1cs_ppzksnark_proof<curve_pp>>();
|
|
|
|
ASSERT_TRUE(proof == newproof);
|
|
ASSERT_TRUE(libsnark::r1cs_ppzksnark_verifier_strong_IC<curve_pp>(
|
|
kp.vk,
|
|
example.primary_input,
|
|
newproof
|
|
));
|
|
}
|
|
}
|
|
|
|
TEST(proofs, g1_deserialization)
|
|
{
|
|
CompressedG1 g;
|
|
curve_G1 expected;
|
|
|
|
// Valid G1 element.
|
|
{
|
|
CDataStream ss(ParseHex("0230644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
expected.X = curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
|
expected.Y = curve_Fq("3969792565221544645472939191694882283483352126195956956354061729942568608776");
|
|
expected.Z = curve_Fq::one();
|
|
|
|
ASSERT_TRUE(g.to_libsnark_g1<curve_G1>() == expected);
|
|
}
|
|
|
|
// Its negation.
|
|
{
|
|
CDataStream ss(ParseHex("0330644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
expected.X = curve_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
|
|
expected.Y = curve_Fq("3969792565221544645472939191694882283483352126195956956354061729942568608776");
|
|
expected.Z = curve_Fq::one();
|
|
|
|
ASSERT_TRUE(g.to_libsnark_g1<curve_G1>() == -expected);
|
|
}
|
|
|
|
// Invalid leading bytes
|
|
{
|
|
CDataStream ss(ParseHex("ff30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46"), SER_NETWORK, PROTOCOL_VERSION);
|
|
|
|
ASSERT_THROW(ss >> g, std::ios_base::failure);
|
|
}
|
|
|
|
// Invalid point
|
|
{
|
|
CDataStream ss(ParseHex("0208c6d2adffacbc8438f09f321874ea66e2fcc29f8dcfec2caefa21ec8c96a77c"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
ASSERT_THROW(g.to_libsnark_g1<curve_G1>(), std::runtime_error);
|
|
}
|
|
|
|
// Point with out of bounds Fq
|
|
{
|
|
CDataStream ss(ParseHex("02ffc6d2adffacbc8438f09f321874ea66e2fcc29f8dcfec2caefa21ec8c96a77c"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
ASSERT_THROW(g.to_libsnark_g1<curve_G1>(), std::logic_error);
|
|
}
|
|
|
|
// Randomly produce valid G1 representations and fail/succeed to
|
|
// turn them into G1 points based on whether they are valid.
|
|
for (size_t i = 0; i < 5000; i++) {
|
|
curve_Fq e = curve_Fq::random_element();
|
|
CDataStream ss(ParseHex("02"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << Fq(e);
|
|
CompressedG1 g;
|
|
ss >> g;
|
|
|
|
try {
|
|
curve_G1 g_real = g.to_libsnark_g1<curve_G1>();
|
|
} catch(...) {
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
TEST(proofs, g2_deserialization)
|
|
{
|
|
CompressedG2 g;
|
|
curve_G2 expected = curve_G2::random_element();
|
|
|
|
// Valid G2 point
|
|
{
|
|
CDataStream ss(ParseHex("0a023aed31b5a9e486366ea9988b05dba469c6206e58361d9c065bbea7d928204a761efc6e4fa08ed227650134b52c7f7dd0463963e8a4bf21f4899fe5da7f984a"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
expected.X = curve_Fq2(
|
|
curve_Fq("5923585509243758863255447226263146374209884951848029582715967108651637186684"),
|
|
curve_Fq("5336385337059958111259504403491065820971993066694750945459110579338490853570")
|
|
);
|
|
expected.Y = curve_Fq2(
|
|
curve_Fq("10374495865873200088116930399159835104695426846400310764827677226300185211748"),
|
|
curve_Fq("5256529835065685814318509161957442385362539991735248614869838648137856366932")
|
|
);
|
|
expected.Z = curve_Fq2::one();
|
|
|
|
ASSERT_TRUE(g.to_libsnark_g2<curve_G2>() == expected);
|
|
}
|
|
|
|
// Its negation
|
|
{
|
|
CDataStream ss(ParseHex("0b023aed31b5a9e486366ea9988b05dba469c6206e58361d9c065bbea7d928204a761efc6e4fa08ed227650134b52c7f7dd0463963e8a4bf21f4899fe5da7f984a"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
expected.X = curve_Fq2(
|
|
curve_Fq("5923585509243758863255447226263146374209884951848029582715967108651637186684"),
|
|
curve_Fq("5336385337059958111259504403491065820971993066694750945459110579338490853570")
|
|
);
|
|
expected.Y = curve_Fq2(
|
|
curve_Fq("10374495865873200088116930399159835104695426846400310764827677226300185211748"),
|
|
curve_Fq("5256529835065685814318509161957442385362539991735248614869838648137856366932")
|
|
);
|
|
expected.Z = curve_Fq2::one();
|
|
|
|
ASSERT_TRUE(g.to_libsnark_g2<curve_G2>() == -expected);
|
|
}
|
|
|
|
// Invalid leading bytes
|
|
{
|
|
CDataStream ss(ParseHex("ff023aed31b5a9e486366ea9988b05dba469c6206e58361d9c065bbea7d928204a761efc6e4fa08ed227650134b52c7f7dd0463963e8a4bf21f4899fe5da7f984a"), SER_NETWORK, PROTOCOL_VERSION);
|
|
|
|
ASSERT_THROW(ss >> g, std::ios_base::failure);
|
|
}
|
|
|
|
|
|
// Invalid point
|
|
{
|
|
CDataStream ss(ParseHex("0b023aed31b5a9e486366ea9988b05dba469c6206e58361d9c065bbea7d928204a761efc6e4fa08ed227650134b52c7f7dd0463963e8a4bf21f4899fe5da7f984b"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
ASSERT_THROW(g.to_libsnark_g2<curve_G2>(), std::runtime_error);
|
|
}
|
|
|
|
// Point with out of bounds Fq2
|
|
{
|
|
CDataStream ss(ParseHex("0a0f3aed31b5a9e486366ea9988b05dba469c6206e58361d9c065bbea7d928204a761efc6e4fa08ed227650134b52c7f7dd0463963e8a4bf21f4899fe5da7f984a"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss >> g;
|
|
|
|
ASSERT_THROW(g.to_libsnark_g2<curve_G2>(), std::logic_error);
|
|
}
|
|
|
|
// Randomly produce valid G2 representations and fail/succeed to
|
|
// turn them into G2 points based on whether they are valid.
|
|
for (size_t i = 0; i < 5000; i++) {
|
|
curve_Fq2 e = curve_Fq2::random_element();
|
|
CDataStream ss(ParseHex("0a"), SER_NETWORK, PROTOCOL_VERSION);
|
|
ss << Fq2(e);
|
|
CompressedG2 g;
|
|
ss >> g;
|
|
|
|
try {
|
|
curve_G2 g_real = g.to_libsnark_g2<curve_G2>();
|
|
} catch(...) {
|
|
|
|
}
|
|
}
|
|
}
|
|
|
|
#include "json_test_vectors.h"
|
|
#include "test/data/g1_compressed.json.h"
|
|
|
|
TEST(proofs, g1_test_vectors)
|
|
{
|
|
UniValue v = read_json(std::string(json_tests::g1_compressed, json_tests::g1_compressed + sizeof(json_tests::g1_compressed)));
|
|
|
|
curve_G1 e = curve_Fr("34958239045823") * curve_G1::one();
|
|
for (size_t i = 0; i < 10000; i++) {
|
|
e = (curve_Fr("34958239045823") ^ i) * e;
|
|
auto expected = CompressedG1(e);
|
|
|
|
expect_test_vector(v[i], expected);
|
|
ASSERT_TRUE(expected.to_libsnark_g1<curve_G1>() == e);
|
|
}
|
|
}
|
|
|
|
#include "test/data/g2_compressed.json.h"
|
|
|
|
TEST(proofs, g2_test_vectors)
|
|
{
|
|
UniValue v = read_json(std::string(json_tests::g2_compressed, json_tests::g2_compressed + sizeof(json_tests::g2_compressed)));
|
|
|
|
curve_G2 e = curve_Fr("34958239045823") * curve_G2::one();
|
|
for (size_t i = 0; i < 10000; i++) {
|
|
e = (curve_Fr("34958239045823") ^ i) * e;
|
|
auto expected = CompressedG2(e);
|
|
|
|
expect_test_vector(v[i], expected);
|
|
ASSERT_TRUE(expected.to_libsnark_g2<curve_G2>() == e);
|
|
}
|
|
}
|
|
|