Ethereum KZG polynomial commitments / EIP-4844 (part 1) (#239)

* common error model for serialization of BLS signatures and KZG objects

* [KZG] add Ethereum's test vectors [skip ci]

* dump progress on KZG

* Stash: trusted setup generator

* implement cache optimized bit-reversal-permutation

* Add generator for the Ethereum test trusted setups

* implement naive deserialization for the trusted setup interchange format

* implement verify_kzg_proof

* Add test skeleton of verify KZG proof

* rebase import fixes

benchmarks/bench_ethereum_bls_signatures.nim

@@ -36,16 +36,15 @@ proc demoKeyGen(): tuple[seckey: SecretKey, pubkey: PublicKey] =
  # The API for keygen is not ready in ethereum_bls_signatures
  let ikm = rng.random_byte_seq(32)
  doAssert cast[ptr BigInt[255]](result.seckey.addr)[].derive_master_secretKey(ikm)
- let ok = result.pubkey.derive_pubkey(result.seckey)
- doAssert ok == cttBLS_Success
+ result.pubkey.derive_pubkey(result.seckey)
 
 proc benchDeserPubkey*(iters: int) =
  let (sk, pk) = demoKeyGen()
  var pk_comp{.noInit.}: array[48, byte]
 
  # Serialize compressed
- let ok = pk_comp.serialize_pubkey_compressed(pk)
- doAssert ok == cttBLS_Success
+ let status = pk_comp.serialize_pubkey_compressed(pk)
+ doAssert status == cttCodecEcc_Success
 
  var pk2{.noInit.}: PublicKey
 
@@ -57,8 +56,8 @@ proc benchDeserPubkeyUnchecked*(iters: int) =
  var pk_comp{.noInit.}: array[48, byte]
 
  # Serialize compressed
- let ok = pk_comp.serialize_pubkey_compressed(pk)
- doAssert ok == cttBLS_Success
+ let status = pk_comp.serialize_pubkey_compressed(pk)
+ doAssert status == cttCodecEcc_Success
 
  var pk2{.noInit.}: PublicKey
 
@@ -73,12 +72,11 @@ proc benchDeserSig*(iters: int) =
  sig_comp{.noInit.}: array[96, byte]
  sig {.noInit.}: Signature
 
- let status = sig.sign(sk, msg)
- doAssert status == cttBLS_Success
+ sig.sign(sk, msg)
 
  # Serialize compressed
- let ok = sig_comp.serialize_signature_compressed(sig)
- doAssert ok == cttBLS_Success
+ let status = sig_comp.serialize_signature_compressed(sig)
+ doAssert status == cttCodecEcc_Success
 
  var sig2{.noInit.}: Signature
 
@@ -93,12 +91,11 @@ proc benchDeserSigUnchecked*(iters: int) =
  sig_comp{.noInit.}: array[96, byte]
  sig {.noInit.}: Signature
 
- let status = sig.sign(sk, msg)
- doAssert status == cttBLS_Success
+ sig.sign(sk, msg)
 
  # Serialize compressed
- let ok = sig_comp.serialize_signature_compressed(sig)
- doAssert ok == cttBLS_Success
+ let status = sig_comp.serialize_signature_compressed(sig)
+ doAssert status == cttCodecEcc_Success
 
  var sig2{.noInit.}: Signature
 
@@ -112,15 +109,14 @@ proc benchSign*(iters: int) =
  var sig: Signature
 
  bench("BLS signature", "BLS12_381 G2", iters):
- let status = sig.sign(sk, msg)
+ sig.sign(sk, msg)
 
 proc benchVerify*(iters: int) =
  let (sk, pk) = demoKeyGen()
  let msg = "Mr F was here"
 
  var sig: Signature
- let ok = sig.sign(sk, msg)
- doAssert ok == cttBLS_Success
+ sig.sign(sk, msg)
 
  bench("BLS verification", "BLS12_381", iters):
  let valid = pk.verify(msg, sig)
@@ -136,8 +132,7 @@ proc benchFastAggregateVerify*(numKeys, iters: int) =
  for i in 0 ..< numKeys:
  let (sk, pk) = demoKeyGen()
  validators[i] = pk
- let status = sigs[i].sign(sk, msg)
- doAssert status == cttBLS_Success
+ sigs[i].sign(sk, msg)
 
  aggSig.aggregate_signatures_unstable_api(sigs)
 
@@ -155,8 +150,7 @@ proc benchVerifyMulti*(numSigs, iters: int) =
  for i in 0 ..< numSigs:
  let (sk, pk) = demoKeyGen()
  sha256.hash(hashedMsg, "msg" & $i)
- let status = sig.sign(sk, hashedMsg)
- doAssert status == cttBLS_Success
+ sig.sign(sk, hashedMsg)
  triplets.add (pk, hashedMsg, sig)
 
  bench("BLS verif of " & $numSigs & " msgs by "& $numSigs & " pubkeys", "BLS12_381", iters):
@@ -178,8 +172,7 @@ proc benchVerifyBatched*(numSigs, iters: int) =
  for i in 0 ..< numSigs:
  let (sk, pk) = demoKeyGen()
  sha256.hash(hashedMsg, "msg" & $i)
- let status = sig.sign(sk, hashedMsg)
- doAssert status == cttBLS_Success
+ sig.sign(sk, hashedMsg)
 
  pubkeys.add pk
  messages.add hashedMsg

benchmarks/bench_evm_modexp_dos.nim

@@ -2,7 +2,7 @@ import
  ../constantine/ethereum_evm_precompiles,
  ./platforms, ./bench_blueprint,
 
- ../constantine/platforms/codecs
+ ../constantine/serialization/codecs
 
 proc report(op: string, elapsedNs: int64, elapsedCycles: int64, iters: int) =
  let ns = elapsedNs div iters

benchmarks/bench_powmod.nim

@@ -2,7 +2,8 @@ import
  ../constantine/math/arithmetic,
  ../constantine/math/io/[io_bigints, io_fields],
  ../constantine/math/config/curves,
- ../constantine/platforms/[abstractions, codecs],
+ ../constantine/platforms/abstractions,
+ ../constantine/serialization/codecs,
  ../constantine/math_arbitrary_precision/arithmetic/bigints_views,
  ../helpers/prng_unsafe,
  ./platforms, ./bench_blueprint

bindings_generators/gen_bindings.nim

@@ -23,11 +23,11 @@ template genBindingsField*(Field: untyped) =
  else:
  {.push noconv, exportc, raises: [].} # No exceptions allowed
 
- func `ctt _ Field _ unmarshalBE`(dst: var Field, src: openarray[byte]) =
+ func `ctt _ Field _ unmarshalBE`(dst: var Field, src: openarray[byte]): bool =
  ## Deserialize
  unmarshalBE(dst, src)
 
- func `ctt _ Field _ marshalBE`(dst: var openarray[byte], src: Field) =
+ func `ctt _ Field _ marshalBE`(dst: var openarray[byte], src: Field): bool =
  marshalBE(dst, src)
  # --------------------------------------------------------------------------------------
  func `ctt _ Field _ is_eq`(a, b: Field): SecretBool =

bindings_generators/gen_header.nim

@@ -68,6 +68,12 @@ typedef __UINT64_TYPE__ uint64_t;
 #else
 #include <stdint.h>
 #endif
+
+#if defined(__STDC_VERSION__) && __STDC_VERSION__>=199901
+# define bool _Bool
+#else
+# define bool unsigned char
+#endif
 """
 
 proc genCttBaseTypedef*(): string =
@@ -115,6 +121,7 @@ void ctt_{libName}_init_NimMain(void);"""
 # -------------------------------------------
 
 let TypeMap {.compileTime.} = newStringTable({
+ "bool": "bool",
  "SecretBool": "secret_bool",
  "SecretWord": "secret_word"
 })
@@ -201,7 +208,10 @@ macro collectBindings*(cBindingsStr: untyped, body: typed): untyped =
  var name = $paramDef[j]
  cBindings &= toCparam(name.split('`')[0], pType)
 
- cBindings &= ");"
+ if fnDef.params[0].eqIdent"bool":
+ cBindings &= ") __attribute__((warn_unused_result));"
+ else:
+ cBindings &= ");"
 
  if defined(CTT_GENERATE_HEADERS):
  result = newConstStmt(cBindingsStr, newLit cBindings)

constantine.nimble

@@ -1,6 +1,6 @@
 packageName = "constantine"
 version = "0.0.1"
-author = "Status Research & Development GmbH"
+author = "Mamy Ratsimbazafy"
 description = "This library provides thoroughly tested and highly-optimized implementations of cryptography protocols."
 license = "MIT or Apache License 2.0"
 

constantine/ciphers/chacha20.nim

@@ -6,7 +6,9 @@
 # * Apache v2 license (license terms in the root directory or at http://www.apache.org/licenses/LICENSE-2.0).
 # at your option. This file may not be copied, modified, or distributed except according to those terms.
 
-import ../platforms/[endians, views]
+import
+ ../platforms/views,
+ ../serialization/endians
 
 # ############################################################
 #

constantine/commitments/README.md

@@ -0,0 +1,27 @@
+# Commitment schemes
+
+https://en.wikipedia.org/wiki/Commitment_scheme
+
+> A commitment scheme is a cryptographic primitive that allows one to commit to a chosen value (or chosen statement) while keeping it hidden to others, with the ability to reveal the committed value later. Commitment schemes are designed so that a party cannot change the value or statement after they have committed to it: that is, commitment schemes are binding.
+
+## Use-cases
+
+An important use-case missing from the Wikipedia article is:
+
+"There exists a bundle of transactions that change the state of my database/ledger/blockchain to this state.". The whole bundle is not needed, only a short proof.
+
+## KZG Polynomial Commitments
+
+- Constant-Size Commitments to Polynomials and Their Applications\
+ Kate, Zaverucha, Goldberg, 2010\
+ https://www.iacr.org/archive/asiacrypt2010/6477178/6477178.pdf\
+ https://cacr.uwaterloo.ca/techreports/2010/cacr2010-10.pdf
+
+- KZG commitments from the Lagrange basis without FFTs
+ Drake, 2020
+ https://ethresear.ch/t/kate-commitments-from-the-lagrange-basis-without-ffts/6950
+
+- KZG Multiproofs
+ Feist, Khovratovich, 2020
+ https://dankradfeist.de/ethereum/2021/06/18/pcs-multiproofs.html\
+ https://github.com/khovratovich/Kate/blob/master/Kate_amortized.pdf