SIGNITC.py

"""
SIGNITC ideal
"""

# Sage imports
from sage.all import (
    ZZ,
    RR,
    log,
    factor
)

from FullRepresentInteger import (
    RepresentIntegerHeuristic
)

from deuring import (
    ideal_to_kernel_crs
)

from ideals import (
    is_integral,
    is_cyclic,
    left_isomorphism
)

from isogenies import (
    torsion_basis
)

from utilities import (
    has_order_D
)

from setup import (
    p,
    Fp2,
    Fp4,
    E0,
    B,
    O0,
    d_s,
    d_T,
    M
)

def j_to_M (j):
    a = Fp2(j)[0];
    b = min(Fp2(j)[1], -Fp2(j)[1]);
    return M(a + b)

def PGen ():
    print("p   =", p);
    print("log_2(p) =", RR(log(p,2)));
    print("d_s =", d_s, "=", factor(d_s));
    print("log_2(d_s) =", RR(log(d_s,2)));
    print("d_T =", d_T, "=", factor(d_T));
    print("log_2(d_T) =", RR(log(d_T,2)));
    print("M =", M);
    P_s, Q_s = torsion_basis(E0,d_s);
    P_T, Q_T = torsion_basis(E0,d_T);
    return P_s, Q_s, P_T, Q_T

def random_message():
    m = M.random_element();
    return m
    
def Com (crs, m):
    gamma = None
    for _ in range(1000):
        gamma = RepresentIntegerHeuristic(d_s**2 * d_T, parity=True)
        if gamma is not None:
            I_sT = O0 * gamma + O0 * d_s * d_T
            I_psi = O0 * gamma.conjugate() + O0 * d_s
            if (I_sT.norm() == d_s * d_T and 
                I_psi.norm() == d_s and 
                is_integral(I_sT) and 
                is_integral(I_psi) and 
                is_cyclic(I_sT) and 
                is_cyclic(I_psi)):
                break
    
    if gamma is None:
        exit("Never found an alg element with norm (d_s^2 * d_T), Exiting...")

    I_s = O0 * gamma + O0 * d_s;
    assert I_s.norm() == d_s
    I_T0 = O0 * gamma + O0 * d_T;
    assert I_T0.norm() == d_T
    assert I_s.intersection(I_T0) == I_sT
    
    K_s = ideal_to_kernel_crs(E0, I_s, d_s, gamma, crs[0], crs[1]); 
    K_s.set_order(d_s);
    phi_s = E0.isogeny(K_s);
    E_s = phi_s.codomain();

    K_T0 = ideal_to_kernel_crs(E0, I_T0, d_T, gamma, crs[2], crs[3]);
    K_T = phi_s(K_T0);

    beta = left_isomorphism(I_sT, I_psi);
    
    K_psi = ideal_to_kernel_crs(E0, I_psi, d_s, gamma.conjugate(), crs[0], crs[1]);
    K_psi.set_order(d_s);
    psi = E0.isogeny(K_psi);
    E_T = psi.codomain();
    j_T = E_T.j_invariant();
    u = m - j_to_M(j_T);
    C = [E_s, K_T, u];
    pi_dec = [gamma, beta];
    return C, pi_dec

def ComVrfy (C):
    if not (C[0].is_supersingular() and C[0].base_field() == Fp4): #TODO change field?
        print("Commitment invalid: E_s is not supersingular or not defined over Fp4.");
        return 0;
    if not C[0] == C[1].curve():
        print("Commitment invalid: K_T is not on E_s.");
        return 0;      
    if not C[1].has_order(ZZ(d_T)):
        print("Commitment invalid: order of K_T is not d_T.");
        return 0;
    if not C[2].parent() == M:
        print("Commitment invalid: u is not in M.");
        return 0;
    print("Commitment is valid.");
    return 1

def DecVrfy (crs, m, C, pi_dec):
    I_sT = O0 * pi_dec[0] + O0 * d_s * d_T;
    assert I_sT.norm() == d_s * d_T
    I_s = O0 * pi_dec[0] + O0 * d_s;
    assert I_s.norm() == d_s
    I_T0 = O0 * pi_dec[0] + O0 * d_T;
    assert I_T0.norm() == d_T
    assert I_s.intersection(I_T0) == I_sT
    
    K_s = ideal_to_kernel_crs(E0, I_s, d_s, pi_dec[0], crs[0], crs[1]);
    K_s.has_order(ZZ(d_s));
    phi_s = E0.isogeny(K_s);
    E_s = phi_s.codomain();
    if not E_s == C[0]: #TODO check for isomorphism and set phi_s = iso o phi_s: E0 -> C[0]?
        print("Decommitment invalid: E_s is not E0 / <K_s>.");
        return 0;
    
    K_T0 = ideal_to_kernel_crs(E0, I_T0, d_T, pi_dec[0], crs[2], crs[3]);
    K_T = phi_s(K_T0);
    if not K_T.weil_pairing(C[1], d_T, algorithm="pari") == 1:
        print("Decommitment invalid: K_T is not phi_s(K_T0).");
        return 0;
        
    if not pi_dec[1].parent() == B:
        print("Decommitment invalid: r is not of the right form.");
        return 0;
    I_psi = I_sT * pi_dec[1];
    assert I_psi == O0 * pi_dec[0].conjugate() + O0 * d_s
    K_psi = ideal_to_kernel_crs(E0, I_psi, d_s, pi_dec[0].conjugate(), crs[0], crs[1]);
    assert K_psi.has_order(ZZ(d_s)) #I_psi.norm()
    psi = E0.isogeny(K_psi);
    E_T = psi.codomain()
    j_T = E_T.j_invariant();
    if not C[2] + j_to_M(j_T) == m:
        print("Decommitment invalid: u is not m - j_to_M(j_T).");
        return 0;
    print("Decommitment is valid.");
    return 1;

def FDecom (C):
    if ComVrfy(C)==0:
        print("Commitment invalid: aborting.");
        return -1
        
    C[1].set_order(d_T);
    j_T = C[0].isogeny(C[1]).codomain().j_invariant();
    m = C[2] + j_to_M(j_T);
    print("m =", m);
    return m