charm-crypto-framework 0.61.1__cp313-cp313-macosx_10_13_universal2.whl

charm/schemes/pkenc/pkenc_rsa.py

@@ -0,0 +1,186 @@
+'''
+**RSA Public Key Encryption Scheme (RSA)**
+
+*Authors:* R. Rivest, A. Shamir, L. Adleman
+
+| **Title:** "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems"
+| **Published in:** Communications of the ACM, 1978
+| **Available from:**
+| **Notes:**
+
+.. rubric:: Scheme Properties
+
+* **Type:** encryption (public key)
+* **Setting:** Integer
+* **Assumption:** RSA (Integer Factorization)
+
+.. rubric:: Implementation
+
+:Authors: J. Ayo Akinyele, Gary Belvin
+:Date: 07/2011
+'''
+
+from charm.core.math.integer import integer,isPrime,gcd,random,randomPrime,toInt
+from charm.toolbox.PKEnc import PKEnc
+from charm.toolbox.PKSig import PKSig
+from charm.toolbox.paddingschemes import OAEPEncryptionPadding,PSSPadding
+from charm.toolbox.conversion import Conversion
+from math import ceil
+
+debug = False
+class RSA():
+    def __init__(self):
+        pass
+    # generate p,q and n
+    def paramgen(self, secparam):
+        while True:
+            p, q = randomPrime(secparam), randomPrime(secparam)
+            if isPrime(p) and isPrime(q) and p != q:
+                N = p * q
+                phi_N = (p - 1) * (q - 1)
+                break
+        return (p, q, N, phi_N)
+    
+    def keygen(self, secparam=1024, params=None):
+        if params:
+            (N, e, d, p, q) = self.convert(params)
+            phi_N = (p - 1) * (q - 1)
+            pk = { 'N':N, 'e':e }
+            sk = { 'phi_N':phi_N, 'd':d , 'N':N}
+            return (pk, sk)
+
+        (p, q, N, phi_N) = self.paramgen(secparam)
+
+        # Use deterministic algorithm to find coprime value instead of random search
+        # This fixes Python 3.12+ hanging issue where random values share common factors
+        # Try common RSA public exponents first, then search incrementally
+        common_exponents = [65537, 3, 5, 17, 257, 641, 6700417]
+        e_value = None
+
+        for candidate in common_exponents:
+            # Use isCoPrime() method which properly checks gcd == 1
+            if phi_N.isCoPrime(candidate):
+                e_value = candidate
+                break
+
+        # If common exponents don't work, search incrementally starting from a larger value
+        if e_value is None:
+            e_value = 65537
+            max_iterations = 10000000  # Large limit for deterministic search
+
+            for iterations in range(max_iterations):
+                # Use isCoPrime() method which properly checks gcd == 1
+                if phi_N.isCoPrime(e_value):
+                    break
+                e_value += 2  # Only try odd numbers (even numbers can't be coprime with even phi_N)
+
+            # Check if we found a coprime value (either broke out of loop or on last iteration)
+            if not phi_N.isCoPrime(e_value):
+                raise RuntimeError(
+                    f"Could not find coprime value after {max_iterations} iterations. "
+                    f"phi_N={phi_N}, last e_value={e_value}, gcd(e_value, phi_N)={gcd(e_value, phi_N)}"
+                )
+
+        # Create modular integer with phi_N as modulus - this is required for modular inverse
+        # Similar to how Rabin does: integer(i) % pk['N']
+        e = integer(e_value, phi_N)
+        d = e ** -1  # Compute modular inverse
+        pk = { 'N':N, 'e':e_value } # Use the plain integer value for public key
+        sk = { 'phi_N':phi_N, 'd':d , 'N':N}
+
+        return (pk, sk)
+    
+    def convert(self, N, e, d, p, q):
+        return (integer(N), integer(e), integer(d), 
+                integer(p), integer(q))
+    
+class RSA_Enc(RSA,PKEnc):
+    """
+    >>> rsa = RSA_Enc()
+    >>> (public_key, secret_key) = rsa.keygen(1024)
+    >>> msg = b'This is a test'
+    >>> cipher_text = rsa.encrypt(public_key, msg)
+    >>> decrypted_msg = rsa.decrypt(public_key, secret_key, cipher_text)
+    >>> decrypted_msg == msg
+    True
+    """
+    def __init__(self, padding=OAEPEncryptionPadding(), params=None):
+        RSA.__init__(self)
+        PKEnc.__init__(self)
+        self.paddingscheme = padding 
+    # m : Bytes
+    def encrypt(self, pk, m, salt=None):
+        octetlen = int(ceil(int(pk['N']).bit_length() / 8.0))
+        EM = self.paddingscheme.encode(m, octetlen, "", salt)
+        if debug: print("EM == >", EM)
+        i = Conversion.OS2IP(EM)
+        ip = integer(i) % pk['N']  #Convert to modular integer
+        return (ip ** pk['e']) % pk['N']
+    
+    def decrypt(self, pk, sk, c):
+        octetlen = int(ceil(int(pk['N']).bit_length() / 8.0))
+        M = (c ** (sk['d'] % sk['phi_N'])) % pk['N']
+        os = Conversion.IP2OS(int(M), octetlen)
+        if debug: print("OS  =>", os)
+        return self.paddingscheme.decode(os)
+    
+class RSA_Sig(RSA, PKSig):
+    """
+    >>> msg = b'This is a test message.'
+    >>> rsa = RSA_Sig()
+    >>> (public_key, secret_key) = rsa.keygen(1024)
+    >>> signature = rsa.sign(secret_key, msg)
+    >>> rsa.verify(public_key, msg, signature)
+    True
+    """
+    '''RSASSA-PSS'''
+    def __init__(self, padding=PSSPadding()):
+        RSA.__init__(self)
+        PKSig.__init__(self)
+        self.paddingscheme = padding 
+
+    def sign(self,sk, M, salt=None):
+        #apply encoding
+        modbits = int(sk['N']).bit_length()
+        k = int(ceil(modbits / 8.0))
+        emLen = int(ceil((modbits -1) / 8.0))
+        
+        
+        em = self.paddingscheme.encode(M, modbits - 1, salt)
+        m = Conversion.OS2IP(em)
+        m = integer(m) % sk['N']  #ERRROR m is larger than N
+        s =  (m ** sk['d']) % sk['N']
+        S = Conversion.IP2OS(s, k)
+        if debug:
+            print("Signing")
+            print("k     =>", k)
+            print("emLen =>", emLen) 
+            print("m     =>", m)
+            print("em    =>", em)
+            print("s     =>", s)
+            print("S     =>", S)
+        return S
+    
+    def verify(self, pk, M, S):
+        modbits = int(pk['N']).bit_length()
+        k = int(ceil(modbits / 8.0))
+        emLen = int(ceil((modbits -1) / 8.0))
+        if len(S) != k:
+            if debug: print("Sig is %s octets long, not %" %(len(S), k))
+            return False
+        s = Conversion.OS2IP(S)
+        s = integer(s) % pk['N']  #Convert to modular integer
+        m = (s ** pk['e']) % pk['N']
+        EM = Conversion.IP2OS(m, emLen)
+        if debug:
+            print("Verifying")
+            print("k     =>", k)
+            print("emLen =>", emLen)
+            print("s     =>", s)
+            print("m       =>", m)
+            print("em      =>", EM)
+            print("S     =>", S)
+        return self.paddingscheme.verify(M, EM, modbits-1)
+        
+    
+    

charm/schemes/pksig/pksig_CW13_z.py

@@ -0,0 +1,135 @@
+'''
+**Chen-Wee Dual System Signature (CW13)**
+
+*Authors:* J. Chen, H. Wee
+
+| **Title:** "Dual System Groups and its Applications - Compact HIBE and More"
+| **Published in:** Manuscript, 2013
+| **Available from:** Manuscript
+| **Notes:** Optimized implementation reducing exponential and multiplication operations.
+
+.. rubric:: Scheme Properties
+
+* **Type:** signature (identity-based)
+* **Setting:** bilinear groups (asymmetric)
+* **Assumption:** SXDH
+
+.. rubric:: Implementation
+
+:Authors: Fan Zhang (zfwise@gwu.edu), Hoeteck Wee
+:Date: 5/2013
+'''
+from charm.toolbox.pairinggroup import PairingGroup,ZR,G1,G2,GT,pair
+from charm.core.crypto.cryptobase import *
+from charm.toolbox.PKSig import PKSig
+from charm.toolbox.matrixops import *
+
+debug = False
+class Sign_CW13(PKSig):
+    def __init__(self, groupObj):
+        PKSig.__init__(self)
+        global group
+        group = groupObj
+        
+    def keygen(self):
+        g2 = group.random(G1)   #generator in G1
+        g1 = group.random(G2)   #generator in G2
+        
+        #generate B and B*
+        B = [[group.random(ZR), group.random(ZR)],[group.random(ZR), group.random(ZR)]]
+       
+        Bt = MatrixTransGroups(B)
+        Bstar= [GaussEliminationinGroups([[Bt[0][0], Bt[0][1], group.init(ZR, 1)],
+                                                  [Bt[1][0], Bt[1][1], group.init(ZR, 0)]]),
+                GaussEliminationinGroups([[Bt[0][0], Bt[0][1], group.init(ZR, 0)],
+                                                  [Bt[1][0], Bt[1][1], group.init(ZR, 1)]])]
+        Bstar = MatrixTransGroups(Bstar)
+
+
+        ## checks Bt * Bstar = identity matrix
+#         for i in self.MatrixMulGroups(Bt, Bstar):
+#             print("[%s,%s]"%(i[0],i[1]))
+            
+        #generate R
+        R = [[group.random(ZR), group.init(ZR, 0)],
+            [group.init(ZR, 0), group.init(ZR, 1)]]
+        
+        #generate A1 and A2
+        A1 =[[group.random(ZR), group.random(ZR)],
+             [group.random(ZR), group.random(ZR)]]
+        A2 =[[group.random(ZR), group.random(ZR)],
+             [group.random(ZR), group.random(ZR)]]
+        k = [group.random(ZR),group.random(ZR)]    #k is a 2 dimentional vector
+        
+        BA1 = MatrixMulGroups(B,A1)
+        BA2 = MatrixMulGroups(B,A2)
+        BsR = MatrixMulGroups(Bstar,R)
+        BsA1R = MatrixMulGroups(MatrixMulGroups(Bstar, MatrixTransGroups(A1)),R)
+        BsA2R = MatrixMulGroups(MatrixMulGroups(Bstar, MatrixTransGroups(A2)),R)
+        b0 = [B[0][0],B[1][0]]
+        b1 = [BA1[0][0],BA1[1][0]]
+        b2 = [BA2[0][0],BA2[1][0]]
+        b0s = [BsR[0][0],BsR[1][0]]
+        b1s = [BsA1R[0][0],BsA1R[1][0]]
+        b2s = [BsA2R[0][0],BsA2R[1][0]]
+
+        #generate the mpk
+        g1b0 = [g1**b0[0], g1**b0[1]]
+        g1b1 = [g1**b1[0], g1**b1[1]]
+        g1b2 = [g1**b2[0], g1**b2[1]]
+        egg = (pair(g2, g1)) ** (k[0]*b0[0] + k[1]*b0[1])
+
+        pk = {'g1':g1, 'g2':g2, 'g1b0':g1b0, 'g1b1':g1b1, 'g1b2': g1b2, 'egg':egg}
+        
+        #generate private parameters
+        sk = { 'k':k, 'b0s':b0s, 'b1s':b1s,'b2s':b2s}
+        
+        if(debug):
+            print("Public parameters...")
+            group.debug(pk)
+            print("Secret parameters...")
+            group.debug(sk)
+        return (pk, sk)
+
+    def sign(self, pk, sk, m):
+        #_ID is an element in ZR, r is an random number in ZR
+        M = group.hash(m, ZR)
+        r = group.random(ZR)
+        
+        sig = {'K0': [pk['g2']**(sk['b0s'][0]*r),
+                        pk['g2']**(sk['b0s'][1]*r)],
+                 'K1': [pk['g2']**(sk['k'][0] + (sk['b2s'][0]+M*sk['b1s'][0])*r),
+                        pk['g2']**(sk['k'][1] + (sk['b2s'][1]+M*sk['b1s'][1])*r)]}
+        return sig
+        
+       
+    def verify(self, pk, sig, m):
+        
+        M = group.hash(m,ZR)
+        C0 = [pk['g1b0'][0], pk['g1b0'][1]]
+        C1 = [(pk['g1b2'][0]*(pk['g1b1'][0]**M)),
+              (pk['g1b2'][1]*(pk['g1b1'][1]**M))]
+        C2 = (pk['egg'])
+
+        mask = self.vpair(C0, sig['K1']) / self.vpair(C1, sig['K0'])
+        return (C2 == mask)
+
+    def vpair(self, g1v, g2v):
+        return pair(g2v[0],g1v[0]) * pair(g2v[1],g1v[1])
+    
+def main():
+
+    group = PairingGroup('MNT224', secparam=1024)    
+    m = "plese sign this message!!!!"
+    pksig = Sign_CW13(group)
+    (pk, sk) = pksig.keygen()
+
+    signature = pksig.sign(pk, sk, m)
+
+    assert pksig.verify(pk, signature, m), "Invalid Verification!!!!"
+    if debug: print("Successful Individual Verification!")
+    
+if __name__ == '__main__':
+    debug = True
+    main()   
+

charm/schemes/pksig/pksig_bls04.py

@@ -0,0 +1,87 @@
+'''
+**Boneh-Lynn-Shacham Signature (BLS04)**
+
+*Authors:* D. Boneh, B. Lynn, H. Shacham
+
+| **Title:** "Short Signatures from the Weil Pairing"
+| **Published in:** Journal of Cryptology, 2004
+| **Available from:** https://crypto.stanford.edu/~dabo/pubs/papers/BLSmultisig.html
+| **Notes:** This is the IBE (2-level HIBE) implementation of the HIBE scheme BB_2.
+
+.. rubric:: Scheme Properties
+
+* **Type:** signature (identity-based)
+* **Setting:** bilinear groups (asymmetric)
+* **Assumption:** CDH
+
+.. rubric:: Implementation
+
+:Authors: J. Ayo Akinyele
+:Date: 1/2011
+'''
+from charm.toolbox.pairinggroup import PairingGroup, ZR, G1, G2, pair
+from charm.core.engine.util import objectToBytes
+from charm.toolbox.IBSig import *
+
+
+debug = False
+
+
+class BLS01(IBSig):
+    """
+    >>> from charm.toolbox.pairinggroup import PairingGroup
+    >>> group = PairingGroup('MNT224')
+    >>> messages = { 'a':"hello world!!!" , 'b':"test message" }
+    >>> ib = BLS01(group)
+    >>> (public_key, secret_key) = ib.keygen()
+    >>> signature = ib.sign(secret_key['x'], messages)
+    >>> ib.verify(public_key, signature, messages) 
+    True
+    """
+    def __init__(self, groupObj):
+        IBSig.__init__(self)
+        global group
+        group = groupObj
+        
+    def dump(self, obj):
+        return objectToBytes(obj, group)
+            
+    def keygen(self, secparam=None):
+        g, x = group.random(G2), group.random()
+        g_x = g ** x
+        pk = { 'g^x':g_x, 'g':g, 'identity':str(g_x), 'secparam':secparam }
+        sk = { 'x':x }
+        return (pk, sk)
+        
+    def sign(self, x, message):
+        M = self.dump(message)
+        if debug: print("Message => '%s'" % M)
+        return group.hash(M, G1) ** x
+        
+    def verify(self, pk, sig, message):
+        M = self.dump(message)
+        h = group.hash(M, G1)
+        if pair(sig, pk['g']) == pair(h, pk['g^x']):
+            return True  
+        return False 
+
+
+def main():
+    groupObj = PairingGroup('MNT224')
+    
+    m = { 'a':"hello world!!!" , 'b':"test message" }
+    bls = BLS01(groupObj)
+    
+    (pk, sk) = bls.keygen()
+    
+    sig = bls.sign(sk['x'], m)
+    
+    if debug: print("Message: '%s'" % m)
+    if debug: print("Signature: '%s'" % sig)     
+    assert bls.verify(pk, sig, m), "Failure!!!"
+    if debug: print('SUCCESS!!!')
+
+
+if __name__ == "__main__":
+    debug = True
+    main()

charm/schemes/pksig/pksig_boyen.py

@@ -0,0 +1,156 @@
+'''
+**Boyen Mesh Signatures (Boyen07)**
+
+*Authors:* X. Boyen
+
+| **Title:** "Mesh Signatures: How to Leak a Secret with Unwitting and Unwilling Participants"
+| **Published in:** EUROCRYPT, 2007
+| **Available from:** http://eprint.iacr.org/2007/094.pdf
+| **Notes:**
+
+.. rubric:: Scheme Properties
+
+* **Type:** signature (ring-based)
+* **Setting:** bilinear groups (asymmetric)
+* **Assumption:** q-SDH
+
+.. rubric:: Implementation
+
+:Authors: J. Ayo Akinyele
+:Date: 11/2011
+'''
+from charm.toolbox.pairinggroup import PairingGroup,ZR,G1,G2,GT,pair
+from charm.toolbox.PKSig import PKSig
+
+debug = False
+
+# need RingSig
+class Boyen(PKSig):
+    """
+    >>> from charm.toolbox.pairinggroup import PairingGroup
+    >>> group = PairingGroup('MNT224')
+    >>> boyen = Boyen(group)
+    >>> master_public_key = boyen.setup()
+    >>> num_signers = 3
+    >>> keys = [ boyen.keygen(master_public_key) for i in range(num_signers)]     
+    >>> public_keys, secret_keys = {},{}
+    >>> for i in range(len(keys)):
+    ...     public_keys[ i+1 ] = keys[ i ][ 0 ]
+    ...     secret_keys[ i+1 ] = keys[ i ][ 1 ]
+    >>> signer = 3
+    >>> secret_key = secret_keys[signer] 
+    >>> msg = 'please sign this new message!'
+    >>> signature = boyen.sign(signer, master_public_key, public_keys, secret_key, msg) 
+    >>> boyen.verify(master_public_key, public_keys, msg, signature) 
+    True
+    """
+    def __init__(self, groupObj):
+        global group
+        group = groupObj
+    
+    def setup(self):
+        global H
+        H = lambda a: group.hash(('1', str(a)), ZR)
+        g1, g2 = group.random(G1), group.random(G2)
+        a = [group.random(ZR) for i in range(3)]
+        A = []; At = [];
+        for i in range(3):
+            A.append(g1 ** a[i])
+            At.append(g2 ** a[i])
+        # public verification key "in the sky" for all users
+        return {'g1':g1, 'g2':g2, 'A':A[0],    'B':A[1],   'C':A[2], 
+                                  'At':At[0], 'Bt':At[1], 'Ct':At[2]}
+    
+    def keygen(self, mpk):
+        a, b, c = group.random(ZR), group.random(ZR), group.random(ZR)
+        A = mpk['g1'] ** a; B = mpk['g1'] ** b; C = mpk['g1'] ** c 
+        At = mpk['g2'] ** a; Bt = mpk['g2'] ** b; Ct = mpk['g2'] ** c
+        sk = {'a':a, 'b':b, 'c':c}
+        pk = {'A':A, 'B':B, 'C':C, 'At':At, 'Bt':Bt, 'Ct':Ct}
+        return (pk, sk)
+
+    def getPKdict(self, mpk, pk, k):
+        A_pk, B_pk, C_pk = {}, {}, {}
+        A_pk[ 0 ] = mpk[ k[0] ]
+        B_pk[ 0 ] = mpk[ k[1] ]
+        C_pk[ 0 ] = mpk[ k[2] ]
+        for i in pk.keys():
+            A_pk[ i ] = pk[ i ][ k[0] ]
+            B_pk[ i ] = pk[ i ][ k[1] ]
+            C_pk[ i ] = pk[ i ][ k[2] ]        
+        return A_pk, B_pk, C_pk
+    
+    def sign(self, index, mpk, pk, sk, M):
+        if debug: print("pk =>", pk.keys())
+        (A_pk, B_pk, C_pk) = self.getPKdict(mpk, pk, ['A', 'B', 'C'])
+        m = H(M)
+        l = len(A_pk.keys())
+        assert index >= 0 and index < l, "invalid index"
+        if debug: print("l defined as =>", l)        
+        s = {}
+        S = {}
+        for i in range(0, l):
+            if i != index:
+               s[i] = group.random(ZR)	
+               S[i] = mpk['g1'] ** s[i]   
+        t = [group.random(ZR) for i in range(l)]
+        # index=0
+        (A, B, C) = A_pk[ 0 ], B_pk[ 0 ], C_pk[ 0 ]
+        prod = (A * (B ** m) * (C ** t[0])) ** -s[0]
+        
+        # 1 -> l
+        for i in range(1, l):
+            if i != index:
+               (A, B, C) = A_pk[i], B_pk[i], C_pk[i]
+               prod *= ((A * (B ** m) * (C ** t[i])) ** -s[i])            
+
+        d = (sk['a'] + (sk['b'] * m) + (sk['c'] * t[index]))  # s[l]
+        S[index] = (mpk['g1'] * prod) ** (1 / d) # S[l]
+        if debug: print("S[", index, "] :=", S[index])
+        sig = { 'S':S, 't':t }
+        return sig
+    
+    def verify(self, mpk, pk, M, sig):
+        if debug: print("Verifying...")
+        At, Bt, Ct = self.getPKdict(mpk, pk, ['At', 'Bt', 'Ct'])
+        l = len(At.keys())
+        D = pair(mpk['g1'], mpk['g2'])
+        S, t = sig['S'], sig['t']
+        m = H(M)
+        dotProd0 = 1
+        for i in range(l):
+            dotProd0 *= pair(S[i], At[i] * (Bt[i] ** m) * (Ct[i] ** t[i]))
+        if dotProd0 == D:
+           return True
+        return False
+
+def main():
+   groupObj = PairingGroup('MNT224')
+   boyen = Boyen(groupObj)
+   mpk = boyen.setup()
+   if debug: print("Pub parameters")
+   if debug: print(mpk, "\n\n")
+   
+   num_signers = 3
+   L_keys = [ boyen.keygen(mpk) for i in range(num_signers)]     
+   L_pk = {}; L_sk = {}
+   for i in range(len(L_keys)):
+       L_pk[ i+1 ] = L_keys[ i ][ 0 ] # pk
+       L_sk[ i+1 ] = L_keys[ i ][ 1 ]
+
+   if debug: print("Keygen...")
+   if debug: print("sec keys =>", L_sk.keys(),"\n", L_sk) 
+
+   signer = 3
+   sk = L_sk[signer] 
+   M = 'please sign this new message!'
+   sig = boyen.sign(signer, mpk, L_pk, sk, M)
+   if debug: print("\nSignature...")
+   if debug: print("sig =>", sig)
+
+   assert boyen.verify(mpk, L_pk, M, sig), "invalid signature!"
+   if debug: print("Verification successful!")
+
+if __name__ == "__main__":
+    debug = True
+    main()

charm/schemes/pksig/pksig_chch.py

@@ -0,0 +1,97 @@
+'''
+**Cha-Cheon Identity-Based Signature (CHCH03)**
+
+*Authors:* J. C. Cha, J. H. Cheon
+
+| **Title:** "An Identity-Based Signature from Gap Diffie-Hellman Groups"
+| **Published in:** PKC, 2003
+| **Available from:** LNCS Vol. 2567, pages 18-30
+| **Notes:**
+
+.. rubric:: Scheme Properties
+
+* **Type:** signature (identity-based)
+* **Setting:** bilinear groups (asymmetric)
+* **Assumption:** Gap-DH
+
+.. rubric:: Implementation
+
+:Authors: J. Ayo Akinyele
+:Date: 11/2011
+'''
+from charm.toolbox.pairinggroup import PairingGroup,ZR,G1,G2,GT,pair
+from charm.toolbox.PKSig import PKSig
+
+debug = False
+class CHCH(PKSig):
+    """
+    >>> from charm.toolbox.pairinggroup import PairingGroup
+    >>> group = PairingGroup('SS512')
+    >>> chch = CHCH(group)
+    >>> (master_public_key, master_secret_key) = chch.setup()
+    >>> ID = "janedoe@email.com"
+    >>> (public_key, secret_key) = chch.keygen(master_secret_key, ID)  
+    >>> msg = "this is a message!" 
+    >>> signature = chch.sign(public_key, secret_key, msg)
+    >>> chch.verify(master_public_key, public_key, msg, signature)
+    True
+    """
+    def __init__(self, groupObj):
+        global group,H1,H2
+        group = groupObj
+        H1 = lambda x: group.hash(x, G1)
+        H2 = lambda x,y: group.hash((x,y), ZR)
+        
+    def setup(self):
+        g2, alpha = group.random(G2), group.random(ZR)
+        msk = alpha
+        P = g2 ** alpha 
+        mpk = {'P':P, 'g2':g2}
+        return (mpk, msk)
+
+    def keygen(self, msk, ID):
+        alpha = msk
+        sk = H1(ID) ** alpha
+        pk = H1(ID)
+        return (pk, sk)
+    
+    def sign(self, pk, sk, M):
+        if debug: print("sign...")
+        s = group.random(ZR)
+        S1 = pk ** s
+        a = H2(M, S1)
+        S2 = sk ** (s + a)
+        return {'S1':S1, 'S2':S2}
+    
+    def verify(self, mpk, pk, M, sig):
+        if debug: print("verify...")
+        (S1, S2) = sig['S1'], sig['S2']
+        a = H2(M, S1)
+        if pair(S2, mpk['g2']) == pair(S1 * (pk ** a), mpk['P']): 
+            return True
+        return False
+
+def main():
+   groupObj = PairingGroup('SS512')
+   chch = CHCH(groupObj)
+   (mpk, msk) = chch.setup()
+
+   _id = "janedoe@email.com"
+   (pk, sk) = chch.keygen(msk, _id)  
+   if debug:
+    print("Keygen...")
+    print("pk =>", pk)
+    print("sk =>", sk)
+ 
+   M = "this is a message!" 
+   sig = chch.sign(pk, sk, M)
+   if debug:
+    print("Signature...")
+    print("sig =>", sig)
+
+   assert chch.verify(mpk, pk, M, sig), "invalid signature!"
+   if debug: print("Verification successful!")
+
+if __name__ == "__main__":
+    debug = True
+    main()