rsa-accumulator 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f38593cbe657293995ebc98f360b248664b552acaf748201f5fa5d4bf27d6aa
-  data.tar.gz: b6d45c16e546ba04b788c41b9426943266cd5bff76b848f1f6fb5eac1e8ad193
+  metadata.gz: cee011044852d3cda974e2a3b92cf0f762cf08982fc12abd153fe762841f0902
+  data.tar.gz: 4db2c478ce578bd09a0a5afad6248f616145116577390cb95a5446fd7eca3081
 SHA512:
-  metadata.gz: 4b43ce23e5961c58adfab5a752a599117a2d13733fdbdab01f2cf608df8a2a99e949edee002e140dcaa3ab94664793b877420c9c9bdc14faa400e6aa6ab9f94f
-  data.tar.gz: 24d9067f9931519c80159879ef4d5d0b125807d197c0ea3985e6f7ff8b0321915fa61e14463378856b8683f16d973a49d292d858b8cc332e51d89955bff82eb7
+  metadata.gz: ad00946ab3cc16554b8013d166807f7265604519373288b49b1ce401037da0f7352215e98a93ef7b180751eb4d6aa3768782da4faf2c814a24c819c6a54fb9a9
+  data.tar.gz: d16fb0cab0cc0c715d590eba67a6a18a9bfef80ebb83cdc51632677a2644819570c60a7e80e82672c98635d33fe9015cbbb970f4641ec7e60c432334eb314c7e

data/.github/workflows/ruby.yml

@@ -1,6 +1,11 @@
 name: Ruby
 
-on: [push]
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
 
 jobs:
   build:
@@ -8,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: ['2.5.x', '2.6.x']
+        ruby: ['3.0', '3.1', '3.2', '3.3']
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
     - name: Set up Ruby environment
-      uses: actions/setup-ruby@v1
+      uses: ruby/setup-ruby@v1
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: Build and test with Rake

data/.ruby-version

@@ -1 +1 @@
-2.6.3
+ruby-3.0.0

data/README.md

@@ -1,4 +1,4 @@
-# RSA Accumulator for Ruby [![Build Status](https://travis-ci.org/chaintope/rsa-accumulatorrb.svg?branch=master)](https://travis-ci.org/chaintope/rsa-accumulatorrb) [![Gem Version](https://badge.fury.io/rb/rsa-accumulator.svg)](https://badge.fury.io/rb/rsa-accumulator) [![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
+# RSA Accumulator for Ruby [![Build Status](https://github.com/chaintope/rsa-accumulatorrb/actions/workflows/ruby.yml/badge.svg?branch=master)](https://github.com/chaintope/rsa-accumulatorrb/actions/workflows/ruby.yml) [![Gem Version](https://badge.fury.io/rb/rsa-accumulator.svg)](https://badge.fury.io/rb/rsa-accumulator) [![MIT License](http://img.shields.io/badge/license-MIT-blue.svg?style=flat)](LICENSE)
 
 
 Cryptographic accumulator based on the strong RSA assumption [BBF18](https://eprint.iacr.org/2018/1188.pdf) in Ruby.
@@ -23,16 +23,30 @@ Or install it yourself as:
 
 ### Setup accumulator
 
-First, initialize the accumulator. Since the accumulator uses groups of unknown order, it can be generated in following ways:
+First, initialize the accumulator. The accumulator works in a group of unknown order, so its
+security depends on **nobody knowing the factorization of the modulus**. There are three ways
+to obtain one:
 
     require 'rsa-accumulator'
-    
-    # using RSA modulus published by RSA Laboratory
+
+    # 1. RSA-2048, the modulus published by RSA Laboratories. Its factorization has never
+    #    been found, so no trusted setup is required. This is the recommended default.
     acc = RSA::Accumulator.generate_rsa2048
 
-    # using Random RSA modulus with a specified bit length(default value is )
+    # 2. A modulus you obtained elsewhere, e.g. from a multi-party trusted setup ceremony.
+    acc = RSA::Accumulator.generate_with_modulus(n)
+
+    # 3. A freshly generated random RSA modulus with the given bit length (default: 3072).
     acc = RSA::Accumulator.generate_random(2048)
 
+> [!WARNING]
+> `generate_random` is a **trusted setup**. It derives the modulus from a newly generated RSA
+> key, so the process that calls it learns `p` and `q`. Anyone holding the factorization can
+> compute an x-th root of any value, and can therefore forge a membership proof for an element
+> that was never added, as well as a non-membership proof for an element that was. Use it only
+> when every verifier of the resulting proofs trusts the party that created the accumulator.
+> Otherwise use `generate_rsa2048` or `generate_with_modulus`.
+
 ### Adding elements and membership proof
 
 You can add arbitrary String data to the accumulator.

data/lib/rsa/acc/functions.rb

@@ -6,29 +6,54 @@ module RSA
 
       using RSA::ACC::Ext
 
+      # Domain separation tags. Elements, Fiat-Shamir challenges and plain hashes are hashed
+      # with a distinct tag each, so that a caller supplied element can never be made to
+      # produce the same digest as a challenge over group elements.
+      ELEMENT_DST = 'RSA-ACC/v1/element'.freeze
+      CHALLENGE_DST = 'RSA-ACC/v1/challenge'.freeze
+      HASH_DST = 'RSA-ACC/v1/hash'.freeze
+
+      # Computes the canonical representative of +elem+ in the quotient group Z_n^* / {+-1}.
+      # Z_n^* always contains the known order-2 element -1, and the Adaptive Root Assumption
+      # which NI-PoE and NI-PoKE2 rely on does not hold in a group with a known low order
+      # element. Identifying y with -y removes it, so every group element MUST be normalized
+      # before it is hashed into a challenge, compared, or published as part of a proof.
+      # @param [Integer] elem an element of Z_n^*.
+      # @param [Integer] modulus modulus of the group.
+      # @return [Integer] the smaller of +elem+ and -+elem+ modulo +modulus+.
+      def normalize(elem, modulus)
+        y = elem % modulus
+        neg = modulus - y
+        y < neg ? y : neg
+      end
+
       # Convert element to prime number.
-      # @param [Array[String] elements an element to be converted.
+      # @param [String] element an element to be converted.
       # @return [Integer] prime number.
       def hash_to_prime(element)
-        nonce = 0
-        loop do
-          candidate = RbNaCl::Hash.blake2b(element + even_hex(nonce)).unpack("C*")
-          candidate[-1] |= 1
-          candidate = candidate.pack('c*').unpack("H*").first.to_i(16)
-          if candidate.to_bn.prime?
-            return candidate
-          end
-          nonce += 1
-        end
+        # Not String#to_s: that would map nil and other objects onto the prime of their
+        # string form, so nil and "" would become the same element.
+        raise TypeError, "element must be a String, got #{element.class}." unless element.is_a?(String)
+        prime_from(ELEMENT_DST, [element])
       end
 
       # Converts a list of elements to an product of prime numbers.
       # @param [Array[String]] elements a list of element.
       # @return [Integer] an product of prime numbers
+      # @raise [ArgumentError] If +elements+ is not a non-empty list of String.
       def elements_to_prime(elements)
+        raise ArgumentError, 'elements must be a non-empty Array of String.' unless valid_elements?(elements)
         elements.map{|e|hash_to_prime(e)}.inject(:*)
       end
 
+      # Check whether +elements+ can be converted to a product of primes. Verifiers use this
+      # to turn a malformed proof into a false result instead of an exception.
+      # @param [Object] elements
+      # @return [Boolean]
+      def valid_elements?(elements)
+        elements.is_a?(Array) && !elements.empty? && elements.all? { |e| e.is_a?(String) }
+      end
+
       # Computes (xy) th root of g given xth and yth roots of g. x and y is co-prime.
       # (a, b) ← Bezout(x, y)
       #
@@ -38,10 +63,14 @@ module RSA
       # @param [Integer] y
       # @return [Integer] w1^b * w2^a
       def shamir_trick(w1, w2, x, y, modulus)
-        raise ArgumentError, 'w1^x != w2^y' unless w1.pow(x, modulus) == w2.pow(y, modulus)
+        w1 = normalize(w1, modulus)
+        w2 = normalize(w2, modulus)
+        unless normalize(w1.pow(x, modulus), modulus) == normalize(w2.pow(y, modulus), modulus)
+          raise ArgumentError, 'w1^x != w2^y'
+        end
         a, b = egcd(x, y)
         raise ArgumentError, 'Inputs does not co-prime.' unless a * x + b * y == 1
-        (w1.pow(b, modulus) * w2.pow(a, modulus)) % modulus
+        normalize(w1.pow(b, modulus) * w2.pow(a, modulus), modulus)
       end
 
       # Computes Bezout coefficients.
@@ -59,18 +88,54 @@ module RSA
       # @param [Array[Integer]] params
       # @return [Integer] prime number of challenge.
       def compute_challenge(*params)
-        hash_to_prime(params.map{|p|even_hex(p)}.join)
+        prime_from(CHALLENGE_DST, params.map { |p| even_hex(p) })
       end
 
       # Computes hash value from +params+.
       # @param [Array[Integer]] params
       # @return [Integer] hash value.
       def blake2_hash(*params)
-        RbNaCl::Hash.blake2b(params.map{|p|even_hex(p)}.join).unpack("H*").first.to_i(16)
+        digest = RbNaCl::Hash.blake2b(encode_fields(HASH_DST, params.map { |p| even_hex(p) }))
+        digest.unpack("H*").first.to_i(16)
       end
 
       private
 
+      # Serializes +dst+ and +fields+ by prefixing each of them with its byte length, so that
+      # the resulting byte string can only be produced by this exact sequence of inputs.
+      # A plain concatenation is ambiguous: even_hex is variable length, so for example
+      # (0x01, 0x2345) and (0x0123, 0x45) both join to "012345".
+      # @param [String] dst domain separation tag.
+      # @param [Array[String]] fields fields to be serialized.
+      # @return [String] a binary string.
+      def encode_fields(dst, fields)
+        fields.inject(length_prefixed(dst)) { |buf, field| buf << length_prefixed(field) }
+      end
+
+      # @param [String] data
+      # @return [String] +data+ prefixed with its byte length as a 64 bit big endian integer.
+      def length_prefixed(data)
+        bytes = data.b
+        [bytes.bytesize].pack('Q>') << bytes
+      end
+
+      # Hashes +fields+ under the domain +dst+ repeatedly, incrementing a nonce, until the
+      # digest is prime.
+      # @param [String] dst domain separation tag.
+      # @param [Array[String]] fields fields to be hashed.
+      # @return [Integer] prime number.
+      def prime_from(dst, fields)
+        nonce = 0
+        loop do
+          digest = RbNaCl::Hash.blake2b(encode_fields(dst, fields + [even_hex(nonce)])).unpack("C*")
+          digest[0] |= 0x80  # keep the output width fixed, a leading zero byte would shorten it
+          digest[-1] |= 1    # 2 is the only even prime, so only odd candidates are worth testing
+          candidate = digest.pack('C*').unpack("H*").first.to_i(16)
+          return candidate if candidate.to_bn.prime?
+          nonce += 1
+        end
+      end
+
       # Convert +num+ to even hex string.
       # @param [Integer] num
       # @return [String] hex string.

data/lib/rsa/acc/poe.rb

@@ -17,9 +17,11 @@ module RSA
       # @param [Integer] result such as result = base^exp.
       # @param [Integer] modulus modulus using computation.
       def prove(base, exp, result, modulus)
+        base = normalize(base, modulus)
+        result = normalize(result, modulus)
         l = compute_challenge(base, exp, result)
         q = exp / l
-        base.pow(q, modulus)
+        normalize(base.pow(q, modulus), modulus)
       end
 
       # Verifies that base^exp = result using the given proof to avoid computation.
@@ -29,9 +31,16 @@ module RSA
       # @param [Integer] proof an proof.
       # @param [Integer] modulus modulus using computation.
       def verify(base, exp, result, proof, modulus)
+        # A proof comes from an untrusted prover, so a malformed one is a false result and
+        # not an exception.
+        return false unless [base, exp, result, proof, modulus].all? { |v| v.is_a?(Integer) }
+        return false unless exp.positive? && modulus > 1
+        base = normalize(base, modulus)
+        result = normalize(result, modulus)
+        proof = normalize(proof, modulus)
         l = compute_challenge(base, exp, result)
         r = exp % l
-        w = (proof.pow(l, modulus) * base.pow(r, modulus)) % modulus
+        w = normalize(proof.pow(l, modulus) * base.pow(r, modulus), modulus)
         w == result
       end
 

data/lib/rsa/acc/poke2.rb

@@ -43,11 +43,14 @@ module RSA
       # @return [RSA::ACC::PoKE2Proof] a proof.
       def prove(base, exp, result, modulus)
         g = RSA::Accumulator::RSA2048_UNKNOWN_ELEM
-        z = g.pow(exp, modulus)
+        base = normalize(base, modulus)
+        result = normalize(result, modulus)
+        z = normalize(g.pow(exp, modulus), modulus)
         l = compute_challenge(base, result, z)
         alpha = blake2_hash(base, result, z, l)
         q, r = exp.divmod(l)
-        RSA::ACC::PoKE2Proof.new(z, ((base * g.pow(alpha, modulus)) % modulus).pow(q, modulus), r)
+        u = (base * g.pow(alpha, modulus)) % modulus
+        RSA::ACC::PoKE2Proof.new(z, normalize(u.pow(q, modulus), modulus), r)
       end
 
       # Verifies that the prover knows +exp+ s.t. +base+ ^ +exp+ = +result+
@@ -57,11 +60,21 @@ module RSA
       # @param [Integer] modulus
       # @return [Boolean] Returns true for successful verification, false otherwise.
       def verify(base, result, proof, modulus)
+        # A proof comes from an untrusted prover, so a malformed one is a false result and
+        # not an exception.
+        return false unless proof.is_a?(RSA::ACC::PoKE2Proof)
+        return false unless [base, result, modulus, proof.z, proof.q, proof.r].all? { |v| v.is_a?(Integer) }
+        return false unless modulus > 1 && !proof.r.negative?
         g = RSA::Accumulator::RSA2048_UNKNOWN_ELEM
-        l = compute_challenge(base, result, proof.z)
-        alpha = blake2_hash(base, result, proof.z, l)
-        lhs = (proof.q.pow(l, modulus) * ((base * g.pow(alpha, modulus) % modulus)).pow(proof.r, modulus)) % modulus
-        rhs = (result * proof.z.pow(alpha, modulus) % modulus)
+        base = normalize(base, modulus)
+        result = normalize(result, modulus)
+        z = normalize(proof.z, modulus)
+        q = normalize(proof.q, modulus)
+        l = compute_challenge(base, result, z)
+        alpha = blake2_hash(base, result, z, l)
+        u = (base * g.pow(alpha, modulus)) % modulus
+        lhs = normalize(q.pow(l, modulus) * u.pow(proof.r, modulus), modulus)
+        rhs = normalize(result * z.pow(alpha, modulus), modulus)
         lhs == rhs
       end
 

data/lib/rsa/acc/proof.rb

@@ -20,10 +20,11 @@ module RSA
       end
 
       # Convert element to prime number.
-      # @return [Integer] prime number of element.
+      # @return [Integer] prime number of element, or nil if the element can not be converted.
       def element_prime
-        return nil if element.nil?
-        element.is_a?(Array) ? elements_to_prime(element) : hash_to_prime(element)
+        elements = element.is_a?(Array) ? element : [element]
+        return nil unless valid_elements?(elements)
+        elements_to_prime(elements)
       end
 
     end
@@ -33,7 +34,7 @@ module RSA
 
       attr_reader :d            # d = g^b
       attr_reader :v            # v = A(current acc)^a
-      attr_reader :gv_inv       # gv_inv = v^{-1}
+      attr_reader :gv_inv       # gv_inv = g * v^{-1}. Advisory only: the verifier re-derives this value and does not trust it.
       attr_reader :poke2_proof  # NI-PoKE2(A, v, a)
       attr_reader :poe_proof    # NI-PoE(d, x, g*v^{-1})
 

data/lib/rsa/acc/version.rb

@@ -1,5 +1,5 @@
 module RSA
   module ACC
-    VERSION = "0.2.0"
+    VERSION = "0.4.0"
   end
 end

data/lib/rsa/accumulator.rb

@@ -15,37 +15,73 @@ module RSA
     RSA2048_UNKNOWN_ELEM = 2
 
     attr_reader :n
-    attr_accessor :value
+    attr_reader :value
     attr_reader :g              # Initial value
     attr_reader :hold_elements  # tha flag which indicate hold product of all elements.
     attr_accessor :products     # (Optional) product of all elements in Accumulator
 
-    # Generate accumulator using RSA2048 modulus.
+    # Generate accumulator using the RSA-2048 challenge modulus.
+    # Nobody is known to hold its factorization, so this requires no trusted setup and is
+    # the right choice whenever the party running the accumulator is not trusted by the
+    # party verifying its proofs.
     # @return [RSA::Accumulator]
     def self.generate_rsa2048(hold_elements: false)
-      new(RSA2048_MODULUS, RSA2048_UNKNOWN_ELEM, hold_elements)
+      new(RSA2048_MODULUS, RSA2048_UNKNOWN_ELEM, RSA2048_UNKNOWN_ELEM, hold_elements)
+    end
+
+    # Generate accumulator with an externally supplied modulus +n+ of unknown factorization.
+    # Use this with a modulus produced by a trusted setup ceremony(e.g. a multi-party
+    # computation) when the RSA-2048 modulus is not desired.
+    # @param [Integer] n modulus whose factorization is unknown to every participant.
+    # @return [RSA::Accumulator]
+    def self.generate_with_modulus(n, hold_elements: false)
+      raise ArgumentError, 'modulus must be an odd integer greater than 4.' unless n.is_a?(Integer) && n > 4 && n.odd?
+      new(n, RSA2048_UNKNOWN_ELEM, RSA2048_UNKNOWN_ELEM, hold_elements)
     end
 
     # Generate accumulator with random modulus.
+    #
+    # WARNING: this is a TRUSTED SETUP. The modulus comes from a freshly generated RSA key,
+    # so the caller learns its factorization. Anyone who knows p and q can compute an x-th
+    # root of any value and therefore forge a membership proof for an element that was never
+    # added, and forge a non-membership proof for an element that was. The factorization is
+    # not retained by this method, but it existed in this process, so the resulting
+    # accumulator is only sound for verifiers who trust the caller. Use
+    # +generate_rsa2048+ or +generate_with_modulus+ when that trust does not hold.
+    #
     # @param [Integer] bit_length bit length of accumulator. Default: 3072 bits.
     # @return [RSA::Accumulator]
     def self.generate_random(bit_length = 3072, hold_elements: false)
       n = OpenSSL::PKey::RSA.generate(bit_length).n.to_i
-      new(n, SecureRandom.random_number(n), hold_elements)
+      initial_value = SecureRandom.random_number(n)
+      # Reject the degenerate elements 0, 1 and n - 1, and anything sharing a factor with n.
+      until initial_value > 1 && initial_value < n - 1 && initial_value.gcd(n) == 1
+        initial_value = SecureRandom.random_number(n)
+      end
+      new(n, initial_value, initial_value, hold_elements)
     end
 
     # Initialize accumulator
     # @param [Integer] n modulus
-    # @param [Integer] value initial value
+    # @param [Integer] value a value of acc.
+    # @param [Integer] initial_acc a value of initial acc.
     # @param [Boolean] hold_elements
+    # @param [Integer] products product of all elements in acc, this param is enable only +hold_elements+ set true.
     # @return [RSA::Accumulator]
-    def initialize(n, value, hold_elements)
+    def initialize(n, value, initial_acc, hold_elements, products = 1)
       @n = n
-      @value = value
-      @g = value
+      self.value = value
+      @g = normalize(initial_acc, n)
       @hold_elements = hold_elements
-      @products = 1 if hold_elements
-      puts "The feature which hold product of all elements is practical feature." if hold_elements
+      @products = products if hold_elements
+    end
+
+    # Set the accumulator value. The value is stored as the canonical representative of the
+    # quotient group Z_n^* / {+-1}, so that the known order-2 element -1 cannot be used to
+    # break the soundness of NI-PoE and NI-PoKE2.
+    # @param [Integer] value a value of acc.
+    def value=(value)
+      @value = normalize(value, n)
     end
 
     # Add element to accumulator and get inclusion proof.
@@ -55,12 +91,7 @@ module RSA
       current_acc = value
       p = elements_to_prime(elements)
       self.value = value.pow(p, n)
-      if hold_elements
-        elements.each do |e|
-          p = hash_to_prime(e)
-          self.products *= p unless products.modulo(p) == 0
-        end
-      end
+      self.products *= p if hold_elements
       RSA::ACC::MembershipProof.new(elements, current_acc, value, RSA::ACC::PoE.prove(current_acc, p, value, n))
     end
 
@@ -76,7 +107,10 @@ module RSA
     # @param [RSA::ACC::MembershipProof] proof inclusion proof.
     # @return [Boolean] If element exist in acc return true, otherwise false.
     def member?(proof)
-      RSA::ACC::PoE.verify(proof.witness, proof.element_prime, value, proof.proof, n)
+      return false unless proof.is_a?(RSA::ACC::MembershipProof)
+      x = proof.element_prime
+      return false if x.nil?
+      RSA::ACC::PoE.verify(proof.witness, x, value, proof.proof, n)
     end
 
     # Verifies a non-membership proof against the current accumulator and +elements+ whose non-inclusion is being proven.
@@ -84,9 +118,18 @@ module RSA
     # @param [RSA::ACC::NonMembershipProof] proof non-membership proof.
     # @return [Boolean]
     def non_member?(elements, proof)
+      return false unless proof.is_a?(RSA::ACC::NonMembershipProof)
+      return false unless valid_elements?(elements)
       x = elements_to_prime(elements)
-      RSA::ACC::PoKE2.verify(value, proof.v, proof.poke2_proof, n) &&
-          RSA::ACC::PoE.verify(proof.d, x, proof.gv_inv, proof.poe_proof, n)
+      return false unless valid_group_elem?(proof.v)
+      return false unless valid_group_elem?(proof.d)
+      v = normalize(proof.v, n)
+      d = normalize(proof.d, n)
+      # g * v^{-1} must be derived by the verifier. If proof#gv_inv were used as-is,
+      # a prover could pick an arbitrary d and claim gv_inv = d^x, which passes for any x.
+      gv_inv = normalize(g * v.pow(-1, n), n)
+      RSA::ACC::PoKE2.verify(value, v, proof.poke2_proof, n) &&
+          RSA::ACC::PoE.verify(d, x, gv_inv, proof.poe_proof, n)
     end
 
     # Generate membership proof for +elements+.
@@ -98,7 +141,7 @@ module RSA
       raise RSA::ACC::Error.new 'This accumulator does not hold the product of the elements.' unless hold_elements
       x = elements_to_prime(elements)
       return nil unless products.modulo(x) == 0
-      witness = g.pow(products / x, n)
+      witness = normalize(g.pow(products / x, n), n)
       RSA::ACC::MembershipProof.new(elements, witness, value, RSA::ACC::PoE.prove(witness, x, value, n))
     end
 
@@ -113,9 +156,9 @@ module RSA
       a, b = egcd(s, x)
       raise ArgumentError, "Inputs not co-prime." unless a * s + b * x == 1
 
-      v = value.pow(a, n)
-      d = g.pow(b, n)
-      gv_inv = (g * v.pow(-1, n)) % n
+      v = normalize(value.pow(a, n), n)
+      d = normalize(g.pow(b, n), n)
+      gv_inv = normalize(g * v.pow(-1, n), n)
 
       poke2_proof = RSA::ACC::PoKE2.prove(value, a, v, n)
       poe_proof = RSA::ACC::PoE.prove(d, x, gv_inv, n)
@@ -130,9 +173,12 @@ module RSA
       return RSA::ACC::MembershipProof.new(proofs.map(&:element).flatten, value, value, RSA::ACC::PoE.prove(value, 1, value, n)) if proofs.empty?
 
       witnesses = proofs.map do |proof|
+        raise RSA::ACC::Error, 'Invalid proof.' unless proof.is_a?(RSA::ACC::MembershipProof)
         p = proof.element_prime
-        raise RSA::ACC::Error, 'Bad witness.' unless proof.witness.pow(p, n) == value
-        [p, proof.witness]
+        raise RSA::ACC::Error, 'Invalid element.' if p.nil?
+        raise RSA::ACC::Error, 'Bad witness.' unless proof.witness.is_a?(Integer)
+        raise RSA::ACC::Error, 'Bad witness.' unless normalize(proof.witness.pow(p, n), n) == value
+        [p, normalize(proof.witness, n)]
       end
 
       current_value = value
@@ -153,14 +199,27 @@ module RSA
     # @param [Array[Integer]] f factorizations of the exponent x = x1, ..., xn.
     # @return [Array{Integer}] array of xi-th root
     def root_factor(*f)
+      raise ArgumentError, 'factorization must not be empty.' if f.empty?
       return [value] if f.size == 1
       half_n = f.size / 2
-      g_l = RSA::Accumulator.new(n, value.pow(f[0...half_n].map.inject(:*), n), false)
-      g_r = RSA::Accumulator.new(n, value.pow(f[half_n..-1].map.inject(:*), n), false)
+      g_l = RSA::Accumulator.new(n, value.pow(f[0...half_n].map.inject(:*), n), g, false)
+      g_r = RSA::Accumulator.new(n, value.pow(f[half_n..-1].map.inject(:*), n), g, false)
       l = g_r.root_factor(*f[0...half_n])
       r = g_l.root_factor(*f[half_n..-1])
       [l, r].flatten
     end
 
+    private
+
+    # Check whether +elem+ is a non-degenerate element of the group Z_n^*.
+    # @param [Integer] elem an element supplied by an untrusted prover.
+    # @return [Boolean]
+    def valid_group_elem?(elem)
+      return false unless elem.is_a?(Integer)
+      y = normalize(elem, n)
+      # y == 1 covers both 1 and n - 1, which are the identity and the order-2 element.
+      y > 1 && y.gcd(n) == 1
+    end
+
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rsa-accumulator
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - azuchi
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-07-14 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rbnacl
@@ -78,7 +77,6 @@ files:
 - ".rspec"
 - ".ruby-gemset"
 - ".ruby-version"
-- ".travis.yml"
 - CODE_OF_CONDUCT.md
 - Gemfile
 - LICENSE.txt
@@ -99,7 +97,6 @@ homepage: https://github.com/chaintope/rsa-accumulatorrb
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -114,8 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: RSA accumulator implementation for Ruby.
 test_files: []

data/.travis.yml

@@ -1,9 +0,0 @@
-language: ruby
-addons:
-  apt:
-    packages:
-      - libsodium-dev
-rvm:
-  - 2.5.5
-  - 2.6.3
-  - 2.7.0