113 pifac tests

src/zkp/pifac.rs

@@ -331,7 +331,11 @@ fn sqrt(num: &BigNumber) -> BigNumber {
 
 #[cfg(test)]
 mod tests {
-    use crate::{paillier::prime_gen, utils::testing::init_testing, zkp::BadContext};
+    use crate::{
+        paillier::prime_gen,
+        utils::{k256_order, random_positive_bn, testing::init_testing},
+        zkp::BadContext,
+    };
     use rand::{prelude::StdRng, Rng, SeedableRng};
 
     use super::*;
@@ -491,6 +495,84 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn proof_elements_should_be_correct() -> Result<()> {
+        let mut rng = init_testing();
+        let (p0, q0) = prime_gen::get_prime_pair_from_pool_insecure(&mut rng).unwrap();
+        let N0 = &p0 * &q0;
+        let setup_params = VerifiedRingPedersen::gen(&mut rng, &())?;
+
+        let input = CommonInput::new(&setup_params, &N0);
+        let proof = PiFacProof::prove(
+            input,
+            ProverSecret::new(&p0, &q0),
+            &(),
+            &mut transcript(),
+            &mut rng,
+        )?;
+        let mut incorrect_proof = proof.clone();
+        let random_bignumber = random_positive_bn(&mut rng, &k256_order());
+        incorrect_proof.p_masked = random_bignumber.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.q_masked = random_bignumber.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        let scheme = VerifiedRingPedersen::gen(&mut rng, &())?;
+        let (random_commitment, random_commmitment_randomness) =
+            scheme.scheme().commit(&random_bignumber, 256, &mut rng);
+        incorrect_proof.p_commitment = random_commitment.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.q_commitment = random_commitment.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.p_mask_commitment = random_commitment.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.q_mask_commitment = random_commitment.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.q_link_commitment = random_commitment.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.link_randomness = random_commmitment_randomness.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        let random_masked_randomness = random_commmitment_randomness.as_masked();
+        incorrect_proof.masked_p_commitment_randomness = random_masked_randomness.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.masked_q_commitment_randomness = random_masked_randomness.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        let mut incorrect_proof = proof.clone();
+        incorrect_proof.masked_p_link = random_masked_randomness.clone();
+        assert!(incorrect_proof
+            .verify(input, &(), &mut transcript())
+            .is_err());
+        Ok(())
+    }
+
     #[test]
     // Make sure the bytes representations for BigNum and BigInt
     // didn't change in a way that would mess up the sqrt funtion