charm-crypto-framework 0.61.1__cp313-cp313-macosx_10_13_universal2.whl

charm/test/zkp_compiler/test_representation_proof.py

@@ -0,0 +1,325 @@
+"""
+Unit tests for Representation ZK proof implementation.
+
+Tests cover:
+- Interactive proof protocol with multiple generators
+- Non-interactive (Fiat-Shamir) proof
+- Serialization/deserialization
+- Different pairing groups
+- Edge cases and error handling
+"""
+
+import unittest
+from charm.toolbox.pairinggroup import PairingGroup, ZR, G1
+from charm.zkp_compiler.representation_proof import RepresentationProof, RepresentationProofData
+
+
+class TestRepresentationProofInteractive(unittest.TestCase):
+    """Tests for interactive Representation protocol."""
+
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+
+    def test_prove_and_verify_interactive_two_generators(self):
+        """Test complete interactive proof cycle with two generators (Pedersen commitment style)."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        # Create prover and verifier
+        prover = RepresentationProof.Prover([x1, x2], self.group)
+        verifier = RepresentationProof.Verifier(self.group)
+
+        # Step 1: Prover creates commitment
+        commitment = prover.create_commitment([g1, g2])
+        self.assertIsNotNone(commitment)
+
+        # Step 2: Verifier creates challenge
+        challenge = verifier.create_challenge()
+        self.assertIsNotNone(challenge)
+
+        # Step 3: Prover creates response
+        responses = prover.create_response(challenge)
+        self.assertIsNotNone(responses)
+        self.assertEqual(len(responses), 2)
+
+        # Step 4: Verifier verifies
+        result = verifier.verify([g1, g2], h, commitment, responses)
+        self.assertTrue(result)
+
+    def test_prove_and_verify_interactive_three_generators(self):
+        """Test complete interactive proof cycle with three generators."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        g3 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        x3 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2) * (g3 ** x3)
+
+        prover = RepresentationProof.Prover([x1, x2, x3], self.group)
+        verifier = RepresentationProof.Verifier(self.group)
+
+        commitment = prover.create_commitment([g1, g2, g3])
+        challenge = verifier.create_challenge()
+        responses = prover.create_response(challenge)
+
+        self.assertEqual(len(responses), 3)
+        result = verifier.verify([g1, g2, g3], h, commitment, responses)
+        self.assertTrue(result)
+
+    def test_invalid_proof_fails_interactive(self):
+        """Test that wrong witnesses fail verification."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        # Use wrong witnesses
+        wrong_x1 = self.group.random(ZR)
+        wrong_x2 = self.group.random(ZR)
+        prover = RepresentationProof.Prover([wrong_x1, wrong_x2], self.group)
+        verifier = RepresentationProof.Verifier(self.group)
+
+        commitment = prover.create_commitment([g1, g2])
+        challenge = verifier.create_challenge()
+        responses = prover.create_response(challenge)
+
+        # Should fail because wrong witnesses
+        result = verifier.verify([g1, g2], h, commitment, responses)
+        self.assertFalse(result)
+
+    def test_prover_commitment_before_response(self):
+        """Test that prover must create commitment before response."""
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        prover = RepresentationProof.Prover([x1, x2], self.group)
+
+        # Try to create response without commitment
+        with self.assertRaises(ValueError):
+            prover.create_response(self.group.random(ZR))
+
+
+class TestRepresentationProofNonInteractive(unittest.TestCase):
+    """Tests for non-interactive (Fiat-Shamir) Representation proof."""
+
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+
+    def test_non_interactive_proof_valid_two_generators(self):
+        """Test Fiat-Shamir transformed proof with two generators."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [x1, x2]
+        )
+
+        self.assertIsNotNone(proof)
+        self.assertIsNotNone(proof.commitment)
+        self.assertIsNotNone(proof.challenge)
+        self.assertIsNotNone(proof.responses)
+        self.assertEqual(len(proof.responses), 2)
+
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g1, g2], h, proof
+        )
+        self.assertTrue(result)
+
+    def test_non_interactive_proof_valid_three_generators(self):
+        """Test Fiat-Shamir transformed proof with three generators."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        g3 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        x3 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2) * (g3 ** x3)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2, g3], h, [x1, x2, x3]
+        )
+
+        self.assertEqual(len(proof.responses), 3)
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g1, g2, g3], h, proof
+        )
+        self.assertTrue(result)
+
+    def test_non_interactive_wrong_witness_fails(self):
+        """Test that wrong witness fails non-interactive verification."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        # Create proof with wrong witnesses
+        wrong_x1 = self.group.random(ZR)
+        wrong_x2 = self.group.random(ZR)
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [wrong_x1, wrong_x2]
+        )
+
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g1, g2], h, proof
+        )
+        self.assertFalse(result)
+
+    def test_non_interactive_tampered_proof_fails(self):
+        """Test that tampered proof fails verification."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [x1, x2]
+        )
+
+        # Tamper with the first response
+        tampered_responses = list(proof.responses)
+        tampered_responses[0] = tampered_responses[0] + self.group.random(ZR)
+        tampered = RepresentationProofData(
+            commitment=proof.commitment,
+            challenge=proof.challenge,
+            responses=tampered_responses,
+            proof_type=proof.proof_type
+        )
+
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g1, g2], h, tampered
+        )
+        self.assertFalse(result)
+
+    def test_proof_deterministic_verification(self):
+        """Test that same proof verifies consistently."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [x1, x2]
+        )
+
+        # Verify multiple times
+        for _ in range(5):
+            result = RepresentationProof.verify_non_interactive(
+                self.group, [g1, g2], h, proof
+            )
+            self.assertTrue(result)
+
+    def test_single_generator_equivalent_to_schnorr(self):
+        """Test that with 1 generator, representation proof works like Schnorr."""
+        g = self.group.random(G1)
+        x = self.group.random(ZR)
+        h = g ** x
+
+        # Create representation proof with single generator
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g], h, [x]
+        )
+
+        self.assertIsNotNone(proof)
+        self.assertEqual(len(proof.responses), 1)
+
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g], h, proof
+        )
+        self.assertTrue(result)
+
+
+class TestRepresentationProofSerialization(unittest.TestCase):
+    """Tests for proof serialization and deserialization."""
+
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+
+    def test_serialization_roundtrip(self):
+        """Test that proof can be serialized and deserialized."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [x1, x2]
+        )
+
+        # Serialize and deserialize
+        serialized = RepresentationProof.serialize_proof(proof, self.group)
+        self.assertIsInstance(serialized, bytes)
+
+        deserialized = RepresentationProof.deserialize_proof(serialized, self.group)
+        self.assertEqual(deserialized.commitment, proof.commitment)
+        self.assertEqual(deserialized.challenge, proof.challenge)
+        self.assertEqual(len(deserialized.responses), len(proof.responses))
+        for i in range(len(proof.responses)):
+            self.assertEqual(deserialized.responses[i], proof.responses[i])
+
+    def test_serialized_proof_verifies(self):
+        """Test that deserialized proof still verifies."""
+        g1 = self.group.random(G1)
+        g2 = self.group.random(G1)
+        x1 = self.group.random(ZR)
+        x2 = self.group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            self.group, [g1, g2], h, [x1, x2]
+        )
+
+        # Serialize, deserialize, then verify
+        serialized = RepresentationProof.serialize_proof(proof, self.group)
+        deserialized = RepresentationProof.deserialize_proof(serialized, self.group)
+
+        result = RepresentationProof.verify_non_interactive(
+            self.group, [g1, g2], h, deserialized
+        )
+        self.assertTrue(result)
+
+
+class TestRepresentationProofWithDifferentGroups(unittest.TestCase):
+    """Test Representation proofs with different pairing groups."""
+
+    def test_with_bn254_group(self):
+        """Test with BN254 pairing group."""
+        self._test_with_group('BN254')
+
+    def test_with_mnt224_group(self):
+        """Test with MNT224 pairing group."""
+        self._test_with_group('MNT224')
+
+    def _test_with_group(self, curve_name):
+        """Helper to test with a specific group."""
+        group = PairingGroup(curve_name)
+        g1 = group.random(G1)
+        g2 = group.random(G1)
+        x1 = group.random(ZR)
+        x2 = group.random(ZR)
+        h = (g1 ** x1) * (g2 ** x2)
+
+        proof = RepresentationProof.prove_non_interactive(
+            group, [g1, g2], h, [x1, x2]
+        )
+        result = RepresentationProof.verify_non_interactive(
+            group, [g1, g2], h, proof
+        )
+        self.assertTrue(result)
+
+
+if __name__ == "__main__":
+    unittest.main()

charm/test/zkp_compiler/test_schnorr_proof.py

@@ -0,0 +1,221 @@
+"""
+Unit tests for Schnorr ZK proof implementation.
+
+Tests cover:
+- Interactive proof protocol
+- Non-interactive (Fiat-Shamir) proof
+- Different pairing groups
+- Edge cases and error handling
+"""
+
+import unittest
+from charm.toolbox.pairinggroup import PairingGroup, ZR, G1
+from charm.zkp_compiler.schnorr_proof import SchnorrProof, Proof
+
+
+class TestSchnorrProofInteractive(unittest.TestCase):
+    """Tests for interactive Schnorr protocol."""
+    
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+        self.g = self.group.random(G1)
+        self.x = self.group.random(ZR)
+        self.h = self.g ** self.x
+    
+    def test_prove_and_verify_interactive(self):
+        """Test complete interactive proof cycle."""
+        # Create prover and verifier
+        prover = SchnorrProof.Prover(self.x, self.group)
+        verifier = SchnorrProof.Verifier(self.group)
+        
+        # Step 1: Prover creates commitment
+        commitment = prover.create_commitment(self.g)
+        self.assertIsNotNone(commitment)
+        
+        # Step 2: Verifier creates challenge
+        challenge = verifier.create_challenge()
+        self.assertIsNotNone(challenge)
+        
+        # Step 3: Prover creates response
+        response = prover.create_response(challenge)
+        self.assertIsNotNone(response)
+        
+        # Step 4: Verifier verifies
+        result = verifier.verify(self.g, self.h, commitment, response)
+        self.assertTrue(result)
+    
+    def test_invalid_proof_fails_interactive(self):
+        """Test that wrong secret fails verification."""
+        wrong_x = self.group.random(ZR)
+        prover = SchnorrProof.Prover(wrong_x, self.group)
+        verifier = SchnorrProof.Verifier(self.group)
+        
+        commitment = prover.create_commitment(self.g)
+        challenge = verifier.create_challenge()
+        response = prover.create_response(challenge)
+        
+        # Should fail because wrong secret
+        result = verifier.verify(self.g, self.h, commitment, response)
+        self.assertFalse(result)
+    
+    def test_prover_commitment_before_response(self):
+        """Test that prover must create commitment before response."""
+        prover = SchnorrProof.Prover(self.x, self.group)
+        
+        # Try to create response without commitment
+        with self.assertRaises(Exception):
+            prover.create_response(self.group.random(ZR))
+
+
+class TestSchnorrProofNonInteractive(unittest.TestCase):
+    """Tests for non-interactive (Fiat-Shamir) Schnorr proof."""
+    
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+        self.g = self.group.random(G1)
+        self.x = self.group.random(ZR)
+        self.h = self.g ** self.x
+    
+    def test_non_interactive_proof_valid(self):
+        """Test Fiat-Shamir transformed proof."""
+        proof = SchnorrProof.prove_non_interactive(
+            self.group, self.g, self.h, self.x
+        )
+        
+        self.assertIsNotNone(proof)
+        self.assertIsNotNone(proof.commitment)
+        self.assertIsNotNone(proof.challenge)
+        self.assertIsNotNone(proof.response)
+        
+        result = SchnorrProof.verify_non_interactive(
+            self.group, self.g, self.h, proof
+        )
+        self.assertTrue(result)
+    
+    def test_non_interactive_wrong_secret_fails(self):
+        """Test that wrong secret fails non-interactive verification."""
+        wrong_x = self.group.random(ZR)
+        proof = SchnorrProof.prove_non_interactive(
+            self.group, self.g, self.h, wrong_x
+        )
+        
+        result = SchnorrProof.verify_non_interactive(
+            self.group, self.g, self.h, proof
+        )
+        self.assertFalse(result)
+    
+    def test_non_interactive_tampered_proof_fails(self):
+        """Test that tampered proof fails verification."""
+        proof = SchnorrProof.prove_non_interactive(
+            self.group, self.g, self.h, self.x
+        )
+        
+        # Tamper with the response
+        tampered = Proof(
+            commitment=proof.commitment,
+            challenge=proof.challenge,
+            response=proof.response + self.group.random(ZR),
+            proof_type=proof.proof_type
+        )
+        
+        result = SchnorrProof.verify_non_interactive(
+            self.group, self.g, self.h, tampered
+        )
+        self.assertFalse(result)
+    
+    def test_proof_deterministic_verification(self):
+        """Test that same proof verifies consistently."""
+        proof = SchnorrProof.prove_non_interactive(
+            self.group, self.g, self.h, self.x
+        )
+        
+        # Verify multiple times
+        for _ in range(5):
+            result = SchnorrProof.verify_non_interactive(
+                self.group, self.g, self.h, proof
+            )
+            self.assertTrue(result)
+
+
+class TestSchnorrProofWithDifferentGroups(unittest.TestCase):
+    """Test Schnorr proofs with different pairing groups."""
+
+    def test_with_bn254_group(self):
+        """Test with BN254 pairing group."""
+        self._test_with_group('BN254')
+
+    def test_with_mnt224_group(self):
+        """Test with MNT224 pairing group."""
+        self._test_with_group('MNT224')
+
+    def _test_with_group(self, curve_name):
+        """Helper to test with a specific group."""
+        group = PairingGroup(curve_name)
+        g = group.random(G1)
+        x = group.random(ZR)
+        h = g ** x
+
+        proof = SchnorrProof.prove_non_interactive(group, g, h, x)
+        result = SchnorrProof.verify_non_interactive(group, g, h, proof)
+        self.assertTrue(result)
+
+
+class TestSchnorrProofSecurity(unittest.TestCase):
+    """Security-focused tests for Schnorr proofs."""
+
+    def setUp(self):
+        """Set up test fixtures."""
+        self.group = PairingGroup('BN254')
+        self.g = self.group.random(G1)
+        self.x = self.group.random(ZR)
+        self.h = self.g ** self.x
+
+    def test_invalid_proof_structure_rejected(self):
+        """Test that proofs with missing attributes are rejected."""
+        # Create a fake proof object without required attributes
+        class FakeProof:
+            pass
+
+        fake_proof = FakeProof()
+        result = SchnorrProof.verify_non_interactive(self.group, self.g, self.h, fake_proof)
+        self.assertFalse(result)
+
+    def test_identity_commitment_rejected(self):
+        """Test that proofs with identity element commitment are rejected."""
+        # Create a valid proof first
+        proof = SchnorrProof.prove_non_interactive(self.group, self.g, self.h, self.x)
+
+        # Replace commitment with identity element
+        identity = self.group.init(G1, 1)
+        tampered_proof = Proof(
+            commitment=identity,
+            challenge=proof.challenge,
+            response=proof.response,
+            proof_type='schnorr'
+        )
+
+        result = SchnorrProof.verify_non_interactive(self.group, self.g, self.h, tampered_proof)
+        self.assertFalse(result)
+
+    def test_challenge_mismatch_rejected(self):
+        """Test that proofs with wrong challenge are rejected."""
+        proof = SchnorrProof.prove_non_interactive(self.group, self.g, self.h, self.x)
+
+        # Tamper with the challenge
+        wrong_challenge = self.group.random(ZR)
+        tampered_proof = Proof(
+            commitment=proof.commitment,
+            challenge=wrong_challenge,
+            response=proof.response,
+            proof_type='schnorr'
+        )
+
+        result = SchnorrProof.verify_non_interactive(self.group, self.g, self.h, tampered_proof)
+        self.assertFalse(result)
+
+
+if __name__ == "__main__":
+    unittest.main()
+