charm-crypto-framework 0.61.1__cp313-cp313-macosx_10_13_universal2.whl

charm/schemes/abenc/pk_hve08.py

@@ -0,0 +1,179 @@
+'''
+**Hidden-Vector Encryption (HVE08)**
+
+*Authors:* Vincenzo Iovino, Giuseppe Persiano
+
+| **Title:** "Hidden-Vector Encryption with Groups of Prime Order"
+| **Published in:** Pairing-Based Cryptography (Pairing), 2008
+| **Available from:** http://dl.acm.org/citation.cfm?id=1431889
+| **Notes:** Predicate encryption supporting hidden-vector queries
+
+.. rubric:: Scheme Properties
+
+* **Type:** predicate encryption (public key)
+* **Setting:** Pairing groups (prime order)
+* **Assumption:** Decisional Linear
+
+.. rubric:: Implementation
+
+:Authors: Matthew W. Pagano
+:Date: 12/2012
+'''
+from charm.toolbox.pairinggroup import PairingGroup,ZR,G1,G2,GT,pair
+
+debug = True
+class HVE08:
+    def __init__(self, groupObj):
+        global group
+        group = groupObj
+
+    def setup(self, n):
+        g1 = group.random(G1)
+        g2 = group.random(G2)
+        y = group.random(ZR)
+        Y = pair(g1, g2) ** y
+
+        T = {}; t = {}; V = {}; v = {}; R = {}
+        r = {}; M = {}; m = {}
+
+        for i in range(0, n):
+            t[i] = group.random(ZR)
+            v[i] = group.random(ZR)
+            r[i] = group.random(ZR)
+            m[i] = group.random(ZR)
+
+            T[i] = g1 ** t[i]
+            V[i] = g1 ** v[i]
+            R[i] = g1 ** r[i]
+            M[i] = g1 ** m[i]
+
+        pk = {'g1':g1, 'g2':g2, 'n':n, 'Y':Y, 'T':T, 'V':V, 'R':R, 'M':M}
+        msk = {'y':y, 't':t, 'v':v, 'r':r, 'm':m}
+        return (pk, msk)
+
+    def keygen(self, pk, msk, yVector):
+        """yVector: expects binary attributes of 0 or 1 and "dont care" attribute is represented by the value 2.
+        """
+        g1 = pk['g1']
+        g2 = pk['g2']
+        n = pk['n']
+        y = msk['y']
+
+        yVectorLen = len(yVector)
+        assert (n == yVectorLen),"pk_hve08.py: length of yVector passed in to keygen is unequal to n passed in to setup."
+
+        numNonDontCares = 0
+        for i in range(0, yVectorLen):
+            if (yVector[i] != 2):
+                numNonDontCares += 1
+
+        if (numNonDontCares == 0):
+            sk = g2 ** y
+            return sk
+
+        a = {}
+        sum_ais_soFar = 0
+
+        for i in range(0, (numNonDontCares - 1)):
+            a[i] = group.random(ZR)
+            sum_ais_soFar += a[i]
+
+        a[(numNonDontCares - 1)] = y - sum_ais_soFar
+        
+        YVector = {}
+        LVector = {}
+        current_a_index = 0
+
+        for i in range(0, yVectorLen):
+            if (yVector[i] == 0):
+                YVector[i] = g2 ** (a[current_a_index] / msk['r'][i])
+                LVector[i] = g2 ** (a[current_a_index] / msk['m'][i])
+                current_a_index += 1
+            elif (yVector[i] == 1):
+                YVector[i] = g2 ** (a[current_a_index] / msk['t'][i])
+                LVector[i] = g2 ** (a[current_a_index] / msk['v'][i])
+                current_a_index += 1
+            elif (yVector[i] == 2): # dont care attribute
+                YVector[i] = group.init(G2)
+                LVector[i] = group.init(G2)
+            else:
+                assert False,"pk_hve08.py:  one of the yVector elements is not 0, 1, or 2 (only allowable values)."
+
+        sk = (YVector, LVector)
+        return sk
+
+    def encrypt(self, M, xVector, pk):
+        g1 = pk['g1']
+        n = pk['n']
+        Y = pk['Y']
+
+        s = group.random(ZR)
+        
+        xVectorLen = len(xVector)
+        assert (n == xVectorLen),"pk_hve08.py:  the length of the xVector passed in to encrypt is unequal to the n value passed in to setup."
+
+        s_i = {}
+
+        for i in range(0, n):
+            s_i[i] = group.random(ZR)
+
+        omega = M * (Y ** (-s))
+        C0 = g1 ** s
+
+        XVector = {}
+        WVector = {}
+
+        for i in range(0, n):
+            if (xVector[i] == 0):
+                XVector[i] = pk['R'][i] ** (s - s_i[i])
+                WVector[i] = pk['M'][i] ** (s_i[i])
+            elif (xVector[i] == 1):
+                XVector[i] = pk['T'][i] ** (s - s_i[i])
+                WVector[i] = pk['V'][i] ** (s_i[i])
+            else:
+                assert False,"pk_hve08.py:  one of the xVector elements passed into encrypt is not either 0 or 1 (only allowable values)."
+
+        CT = (omega, C0, XVector, WVector)
+        return CT
+
+    def decrypt(self, CT, sk):
+        (omega, C0, XVector, WVector) = CT
+
+        try:
+            (YVector, LVector) = sk
+        except:
+            M = omega * pair(C0, sk)
+            return M
+
+        dotProd = 1
+
+        n = len(YVector)
+        if ( (n != len(LVector)) or (n != len(XVector)) or (n != len(WVector)) ):
+            assert False, "pk_hve08.py:  lengths of the vectors passed to decrypt are unequal in at least one case."
+        for i in range(0, n):
+            if ( (YVector[i] != group.init(G2)) and (LVector[i] != group.init(G2)) ):
+                dotProd *= ( pair(XVector[i], YVector[i]) * pair(WVector[i], LVector[i]) )
+
+        M = omega * dotProd
+        return M
+
+def main():
+    grp = PairingGroup("MNT224")
+
+    hve08 = HVE08(grp)
+    (pk, msk) = hve08.setup(4)
+    sk = hve08.keygen(pk, msk, [0, 1, 0, 0])
+    M = group.random(GT)
+    print(M)
+    print("\n\n")
+    CT = hve08.encrypt(M, [0, 1, 0, 0], pk)
+    M2 = hve08.decrypt(CT, sk)
+    print(M2)
+    if (M == M2):
+        print("success")
+    else:
+        print("failed")
+
+if __name__ == "__main__":
+    debug = True
+    main()

charm/schemes/abenc/waters11.py

@@ -0,0 +1,143 @@
+'''
+**Ciphertext-Policy ABE: Expressive and Efficient (Waters11)**
+
+*Authors:* Brent Waters
+
+| **Title:** "Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization"
+| **Published in:** Public Key Cryptography (PKC), 2011
+| **Available from:** https://doi.org/10.1007/978-3-642-19379-8_4
+| **Notes:** Asymmetric version of the scheme in Section 3
+
+.. rubric:: Scheme Properties
+
+* **Type:** ciphertext-policy attribute-based encryption
+* **Setting:** Pairing groups
+* **Assumption:** Decisional Parallel Bilinear Diffie-Hellman Exponent
+
+.. rubric:: Implementation
+
+:Authors: Shashank Agrawal
+:Date: 05/2016
+'''
+
+from charm.toolbox.pairinggroup import PairingGroup, ZR, G1, G2, GT, pair
+from charm.toolbox.ABEnc import ABEnc
+from charm.toolbox.msp import MSP
+
+debug = False
+
+
+class Waters11(ABEnc):
+
+    def __init__(self, group_obj, uni_size, verbose=False):
+        ABEnc.__init__(self)
+        self.group = group_obj
+        self.uni_size = uni_size  # bound on the size of the universe of attributes
+        self.util = MSP(self.group, verbose)
+
+    def setup(self):
+        """
+        Generates public key and master secret key.
+        """
+
+        if debug:
+            print('Setup algorithm:\n')
+
+        # pick a random element each from two source groups and pair them
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G2)
+        alpha = self.group.random(ZR)
+        g1_alpha = g1 ** alpha
+        e_gg_alpha = pair(g1_alpha, g2)
+
+        a = self.group.random(ZR)
+        g1_a = g1 ** a
+
+        h = [0]
+        for i in range(self.uni_size):
+            h.append(self.group.random(G1))
+
+        pk = {'g1': g1, 'g2': g2, 'g1_a': g1_a, 'h': h, 'e_gg_alpha': e_gg_alpha}
+        msk = {'g1_alpha': g1_alpha}
+        return pk, msk
+
+    def keygen(self, pk, msk, attr_list):
+        """
+        Generate a key for a set of attributes.
+        """
+
+        if debug:
+            print('Key generation algorithm:\n')
+
+        t = self.group.random(ZR)
+        k0 = msk['g1_alpha'] * (pk['g1_a'] ** t)
+        L = pk['g2'] ** t
+
+        K = {}
+        for attr in attr_list:
+            K[attr] = pk['h'][int(attr)] ** t
+
+        return {'attr_list': attr_list, 'k0': k0, 'L': L, 'K': K}
+
+    def encrypt(self, pk, msg, policy_str):
+        """
+         Encrypt a message M under a monotone span program.
+        """
+
+        if debug:
+            print('Encryption algorithm:\n')
+
+        policy = self.util.createPolicy(policy_str)
+        mono_span_prog = self.util.convert_policy_to_msp(policy)
+        num_cols = self.util.len_longest_row
+
+        # pick randomness
+        u = []
+        for i in range(num_cols):
+            rand = self.group.random(ZR)
+            u.append(rand)
+        s = u[0]    # shared secret
+
+        c0 = pk['g2'] ** s
+
+        C = {}
+        D = {}
+        for attr, row in mono_span_prog.items():
+            cols = len(row)
+            sum = 0
+            for i in range(cols):
+                sum += row[i] * u[i]
+            attr_stripped = self.util.strip_index(attr)
+            r_attr = self.group.random(ZR)
+            c_attr = (pk['g1_a'] ** sum) / (pk['h'][int(attr_stripped)] ** r_attr)
+            d_attr = pk['g2'] ** r_attr
+            C[attr] = c_attr
+            D[attr] = d_attr
+
+        c_m = (pk['e_gg_alpha'] ** s) * msg
+
+        return {'policy': policy, 'c0': c0, 'C': C, 'D': D, 'c_m': c_m}
+
+    def decrypt(self, pk, ctxt, key):
+        """
+         Decrypt ciphertext ctxt with key key.
+        """
+
+        if debug:
+            print('Decryption algorithm:\n')
+
+        nodes = self.util.prune(ctxt['policy'], key['attr_list'])
+        if not nodes:
+            print ("Policy not satisfied.")
+            return None
+
+        prodG = 1
+        prodGT = 1
+
+        for node in nodes:
+            attr = node.getAttributeAndIndex()
+            attr_stripped = self.util.strip_index(attr)
+            prodG *= ctxt['C'][attr]
+            prodGT *= pair(key['K'][attr_stripped], ctxt['D'][attr])
+
+        return (ctxt['c_m'] * pair(prodG, key['L']) * prodGT) / (pair(key['k0'], ctxt['c0']))

charm/schemes/aggrsign_MuSig.py

@@ -0,0 +1,150 @@
+'''
+**MuSig: Key Aggregation for Schnorr Signatures (MuSig)**
+
+*Authors:* Gregory Maxwell, Andrew Poelstra, Yannick Seurin, Pieter Wuille
+
+| **Title:** "Simple Schnorr Multi-Signatures with Applications to Bitcoin"
+| **Published in:** ePrint Archive, 2018
+| **Available from:** https://eprint.iacr.org/2018/068
+| **Notes:** Designed for Bitcoin multi-signature applications
+
+.. rubric:: Scheme Properties
+
+* **Type:** aggregate signature (Schnorr-based)
+* **Setting:** elliptic curve groups
+* **Assumption:** DL
+
+.. rubric:: Implementation
+
+:Authors: Lovesh Harchandani
+:Date: 6/2018
+'''
+
+from functools import reduce
+
+from charm.toolbox.eccurve import secp256k1
+from charm.toolbox.ecgroup import ZR, G, ECGroup
+from charm.core.engine.util import objectToBytes
+
+
+debug = False
+
+
+class MuSig:
+    def __init__(self, groupObj):
+        global group
+        group = groupObj
+
+    def keygen(self, g, secparam=None):
+        x = group.random()
+        g_x = g ** x
+        pk = {'g^x': g_x, 'g': g, 'identity': str(g_x), 'secparam': secparam}
+        sk = {'x': x}
+        return pk, sk
+
+    def sign(self, nonce, sk, pk, challenge, all_pub_keys):
+        hash_of_pub_keys = MuSig.hash_pub_keys(all_pub_keys)
+        h = group.hash(MuSig.dump(pk['g^x']) + MuSig.dump(hash_of_pub_keys), ZR)
+        return nonce + challenge * sk['x'] * h
+
+    def verify(self, pub_keys, sig, message):
+        apk = self.aggregated_pub_key(pub_keys)
+        R, s = sig
+        challenge = self.compute_challenge(apk, R, message)
+        g = pub_keys[0]['g']
+        return g ** s == R * (apk ** challenge)
+
+    @staticmethod
+    def aggregate_sigs(signatures):
+        return sum(signatures)
+
+    @staticmethod
+    def new_nonce():
+        return group.random()
+
+    @staticmethod
+    def aggregate_nonce(g, nonces):
+        return MuSig.product([g ** n for n in nonces])
+
+    @staticmethod
+    def hash_pub_keys(pub_keys):
+        acc = b''
+        for p in pub_keys:
+            acc += MuSig.dump(p['g^x'])
+        return group.hash(acc, ZR)
+
+    @staticmethod
+    def aggregated_pub_key(pub_keys):
+        hash_of_pub_keys = MuSig.hash_pub_keys(pub_keys)
+        hash_dump = MuSig.dump(hash_of_pub_keys)
+        xs = []
+        for pk in pub_keys:
+            d = MuSig.dump(pk['g^x']) + hash_dump
+            xs.append(pk['g^x'] ** group.hash(d, ZR))
+        return MuSig.product(xs)
+
+    @staticmethod
+    def compute_challenge(aggregated_pub_key, aggregate_nonce, message):
+        m = MuSig.dump(message)
+        message_hash = group.hash(m, ZR)
+        return group.hash(MuSig.dump(aggregated_pub_key) + MuSig.dump(aggregate_nonce) + MuSig.dump(message_hash))
+
+    @staticmethod
+    def product(seq):
+        return reduce(lambda x, y: x * y, seq)
+
+    @staticmethod
+    def dump(obj):
+        return objectToBytes(obj, group)
+
+
+def main():
+    grp = ECGroup(secp256k1)
+    ms = MuSig(grp)
+    g = grp.random(G)
+    if debug:
+        print('Generator...', g)
+
+    msg = 'hello there'
+    num_signers = 5
+
+    if debug:
+        print('{} signers will sign {}'.format(num_signers, msg))
+
+    signers = [ms.keygen(g) for _ in range(num_signers)]
+
+    nonces = [ms.new_nonce() for _ in range(num_signers)]
+    an = ms.aggregate_nonce(g, nonces)
+    all_pub_keys = [signer[0] for signer in signers]
+
+    if debug:
+        print('Public keys...')
+        for pk in all_pub_keys:
+            print(pk)
+
+    apk = ms.aggregated_pub_key(all_pub_keys)
+    if debug:
+        print('Aggregated Public key: ', apk)
+
+    challenge = ms.compute_challenge(apk, an, msg)
+    sigs = [ms.sign(nonces[i], signers[i][1], signers[i][0], challenge, all_pub_keys) for i in range(num_signers)]
+
+    if debug:
+        print('Signatures...')
+        for sig in sigs:
+            print(sig)
+
+    asig = ms.aggregate_sigs(sigs)
+
+    if debug:
+        print('Aggregated signature: ', asig)
+
+    assert ms.verify(all_pub_keys, (an, asig), msg), 'Aggregated sig verification failed'
+
+    if debug:
+        print('Verification succeeded')
+
+
+if __name__ == "__main__":
+    debug = True
+    main()