Commit a22da054 authored by rejection-free's avatar rejection-free
Browse files

Updating parameters set

parent 747b01c8

Makefile

+6 −2
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ LIBS += $(libgmp) 


.PHONY: default all

default: lib

all: lib-all

all: clean-all lib-all params



LAZER_DIR = lazer
@@ -193,7 +193,9 @@ tests/rf-quad-eval-test: tests/rf-quad-eval-test.c $(TESTDEPS) tests/rf-quad-eva 
tests/rf-quad-many-test: tests/rf-quad-many-test.c $(TESTDEPS) tests/rf-quad-params1.h tests/rf-quad-params2.h tests/rf-quad-params3.h tests/rf-quad-params4.h tests/rf-quad-params5.h

	$(CC) $(CPPFLAGS) $(CFLAGS) -I. -I$(LAZER_DIR) -I$(LAZER_DIR)/tests -o $@ $< $(TESTLIBS)



.PHONY: clean

.PHONY: clean clean-all

clean-all: clean clean-params



clean:

	rm -f lazer.h src/lazer.c liblazer.a liblazer.so 

	cd scripts && rm -f moduli.sage.py rf-abdlop-codegen.sage.py rf-quad-codegen.sage.py rf-quad-eval-codegen.sage.py
@@ -202,3 +204,5 @@ clean: 
	cd $(THIRD_PARTY_DIR) && rm -rf $(HEXL_SUBDIR)

	cd tests && rm -f *.o *.dSYM && cd .. && rm -f $(TESTS) && rm -f sage-test.sage.py  



clean-params:

	cd tests && rm -f *.h
 
 No newline at end of file

params/params1.sage

+0 −1
Original line number Diff line number Diff line
@@ -4,5 +4,4 @@ log2q = 60 # ring modulus bits 
d = 64                      # ring degree



m_1 = 10                     # length of bounded message s1 (that would be considered as s1 in lnp with lazer)



l = 2                       # length of unbounded message m (that would be considered as m in lnp with lazer)

scripts/rf_abdlop_param.sage

+11 −11
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ import time 
from sage.stats.distributions.discrete_gaussian_polynomial import DiscreteGaussianDistributionPolynomialSampler

from estimator import *



# We do not claim the knowledge of this script and only modify the existant ones from the script subdirectory from the LaZer Library

# We do not claim the knowledge of this script and only modify the existant ones from the script subdirectory from the LaZer Library.



mp.mp.prec = 512 # precision for mp

prec = 8  # precision for nstr
@@ -93,13 +93,13 @@ m_1 = m_1 + l # We keep l as the script of parameters can be used for the lnp fr 
            # We just show here that we do not need to separate bounded and unbounded message: setting m_1 to (m_1 + l) and l to 0

            # Third point: we enhance k * as we define the commitment scheme over the randomized encoding of size k * m_1

            # and need to provide security for this length and not for m_1 only      



l = 0

### choices

k = 2

b = 2^(log2q//k)

p = b ** k + 1

lext = 0

l = 0





if d not in [64, 128]:

    err("d not in [64,128]")
@@ -248,7 +248,7 @@ delta_mlwe = max(findMLWEdelta(kmlwe, d, p, varsigma_2()),findMLWEdelta(kmlwe, d 


logp = ceil(mp.log(p,2))



full_size = kmsis * d * (logp - D) + l * d * logp 

full_size = kmsis * d * (logp - D) + lext * d * logp 



hint = 2.25 * kmsis * d
@@ -262,21 +262,21 @@ enablePrint() 
printv(f"auto-generated by rf-abdlop-codegen.sage from {params_file}.")

printv(f"")



if not (kmlwe >= 0 and kmlwe == m_2 - kmsis - l):

if not (kmlwe >= 0 and kmlwe == m_2 - kmsis):

    err("protocol not simulatable because of the parameters")



printv(

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 - l + m_2}) with bound={nstr(bound_binding(), prec)})") 

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_binding(), prec)})") 



printv(

    f"the commitment scheme is hiding under MLWE({kmsis+l},{kmlwe}) with sd={nstr(sigma_2, prec)})") 

    f"the commitment scheme is hiding under MLWE({kmsis},{kmlwe}) with sd={nstr(sigma_2, prec)})") 



printv(

    f"protocol is simulatable under Hint-MLWE implied by MLWE({kmsis+l},{kmlwe}) with sd={nstr(varsigma_2(), prec)})") 

    f"protocol is simulatable under Hint-MLWE implied by MLWE({kmsis},{kmlwe}) with sd={nstr(varsigma_2(), prec)})") 



eknow = mpf(1)/mpf(Csize)

printv(

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1- l + m_2}) with bound={nstr(bound_know_soundness(), prec)})")

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_know_soundness(), prec)})")



# print params

printv(f"")
@@ -291,7 +291,7 @@ printv(f"gamma = {gamma}, log(gamma) ~ {nstr(mp.log(gamma,2),prec)}") 
printv(f"m = (q-1)/gamma = {m}, log(m) ~ {nstr(mp.log(m,2),prec)}")

printv(f"")

printv(f"Dimensions of secrets")

printv(f"s1: m_1 = {(m_1-l)/k}")

printv(f"s1: m_1 = {(m_1)}")

printv(f"s2: m_2 = {m_2}")

printv(f"")

printv(f"Size of secrets")
@@ -363,7 +363,7 @@ out += f""" 
static const int_srcptr {name}_Ppmodq[] = {Ppmodq_array};

static const polyring_t {name}_ring = {{{{{name}_q, {d}, {ceil(mp.log(p-1,2))}, {log2d}, moduli_d{d}, {nmoduli}, {name}_Pmodq, {name}_Ppmodq, {name}_inv2}}}};

static const dcompress_params_t {name}_dcomp = {{{{ {name}_q, {name}_qminus1, {name}_m, {name}_mby2, {name}_gamma, {name}_gammaby2, {name}_pow2D, {name}_pow2Dby2, {D}, {m % 2}, {ceil(mp.log(m,2))} }}}};

static const rf_abdlop_params_t {name} = {{{{ {name}_ring, {name}_dcomp, {name}_b, {m_1}, {m_2}, {l}, {lext}, {kmsis}, {name}_Bsq, {omega}, {omega_bits}, {eta}, {name}_sigma_1, {ceil(mp.log(sigma_1,2))}, {name}_sigma_2, {ceil(log(sigma_2,2))}, {name}_frak_s1, {ceil(mp.log(frak_s_1,2))}, {name}_frak_s2, {ceil(mp.log(frak_s_2,2))}}}}};

static const rf_abdlop_params_t {name} = {{{{ {name}_ring, {name}_dcomp, {name}_b, {m_1}, {m_2},{0}, {lext}, {kmsis}, {name}_Bsq, {omega}, {omega_bits}, {eta}, {name}_sigma_1, {ceil(mp.log(sigma_1,2))}, {name}_sigma_2, {ceil(log(sigma_2,2))}, {name}_frak_s1, {ceil(mp.log(frak_s_1,2))}, {name}_frak_s2, {ceil(mp.log(frak_s_2,2))}}}}};

"""



printc(out)

scripts/rf_quad_eval_param.sage

+4 −4
Original line number Diff line number Diff line
@@ -270,17 +270,17 @@ if not (kmlwe >= 0 and kmlwe == m_2 - kmsis - lext): 
    err("protocol not simulatable because of the parameters")



printv(

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 - lext + m_2}) with bound={nstr(bound_binding(), prec)})") 

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_binding(), prec)})") 



printv(

    f"the commitment scheme is hiding under MLWE({kmsis+l},{kmlwe}) with sd={nstr(sigma_2, prec)})") 

    f"the commitment scheme is hiding under MLWE({kmsis+lext},{kmlwe}) with sd={nstr(sigma_2, prec)})") 



printv(

    f"protocol is simulatable under Hint-MLWE implied by MLWE({kmsis+lext},{kmlwe}) with sd={nstr(varsigma_2(), prec)})") 



eknow = mpf(1)/mpf(Csize)

printv(

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1- lext + m_2}) with bound={nstr(bound_know_soundness(), prec)})")

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_know_soundness(), prec)})")



# print params

printv(f"")
@@ -295,7 +295,7 @@ printv(f"gamma = {gamma}, log(gamma) ~ {nstr(mp.log(gamma,2),prec)}") 
printv(f"m = (q-1)/gamma = {m}, log(m) ~ {nstr(mp.log(m,2),prec)}")

printv(f"")

printv(f"Dimensions of secrets")

printv(f"s1: m_1 = {(m_1-l)/k}")

printv(f"s1: m_1 = {m_1-l}")

printv(f"s2: m_2 = {m_2}")

printv(f"")

printv(f"Size of secrets")

scripts/rf_quad_param.sage

+9 −10
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ import time 
from sage.stats.distributions.discrete_gaussian_polynomial import DiscreteGaussianDistributionPolynomialSampler

from estimator import *



# We do not claim the knowledge of this script and only modify the existant ones from the script subdirectory from the LaZer Library

# We do not claim the knowledge of this script and only modify the existant ones from the script subdirectory from the LaZer Library.



mp.mp.prec = 512 # precision for mp

prec = 8  # precision for nstr
@@ -94,12 +94,14 @@ m_1 = m_1 + l # We keep l as the script of parameters can be used for the lnp fr 
            # Third point: we enhance k * as we define the commitment scheme over the randomized encoding of size k * m_1

            # and need to provide security for this length and not for m_1 only      



l = 0



### choices

k = 2

b = 2^(log2q//k)

p = b ** k + 1

lext = 1  # fixed for quad-proof

l = 0





if d not in [64, 128]:

    err("d not in [64,128]")
@@ -266,17 +268,17 @@ if not (kmlwe >= 0 and kmlwe == m_2 - kmsis - lext): 
    err("protocol not simulatable because of the parameters")



printv(

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 - lext + m_2}) with bound={nstr(bound_binding(), prec)})") 

    f"the commitment scheme is binding under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_binding(), prec)})") 



printv(

    f"the commitment scheme is hiding under MLWE({kmsis+l},{kmlwe}) with sd={nstr(sigma_2, prec)})") 

    f"the commitment scheme is hiding under MLWE({kmsis+lext},{kmlwe}) with sd={nstr(sigma_2, prec)})") 



printv(

    f"protocol is simulatable under Hint-MLWE implied by MLWE({kmsis+lext},{kmlwe}) with sd={nstr(varsigma_2(), prec)})") 



eknow = mpf(1)/mpf(Csize)

printv(

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1- lext + m_2}) with bound={nstr(bound_know_soundness(), prec)})")

    f"protocol is knowledge-sound with knowledge error <= 2^({nstr(mp.ceil(mp.log(eknow,2)),prec)}) under MSIS({kmsis},{k*m_1 + m_2}) with bound={nstr(bound_know_soundness(), prec)})")



# print params

printv(f"")
@@ -291,7 +293,7 @@ printv(f"gamma = {gamma}, log(gamma) ~ {nstr(mp.log(gamma,2),prec)}") 
printv(f"m = (q-1)/gamma = {m}, log(m) ~ {nstr(mp.log(m,2),prec)}")

printv(f"")

printv(f"Dimensions of secrets")

printv(f"s1: m_1 = {(m_1-l)/k}")

printv(f"s1: m_1 = {m_1}")

printv(f"s2: m_2 = {m_2}")

printv(f"")

printv(f"Size of secrets")
@@ -363,13 +365,10 @@ out += f""" 
static const int_srcptr {name}_Ppmodq[] = {Ppmodq_array};

static const polyring_t {name}_ring = {{{{{name}_q, {d}, {ceil(mp.log(p-1,2))}, {log2d}, moduli_d{d}, {nmoduli}, {name}_Pmodq, {name}_Ppmodq, {name}_inv2}}}};

static const dcompress_params_t {name}_dcomp = {{{{ {name}_q, {name}_qminus1, {name}_m, {name}_mby2, {name}_gamma, {name}_gammaby2, {name}_pow2D, {name}_pow2Dby2, {D}, {m % 2}, {ceil(mp.log(m,2))} }}}};

static const rf_abdlop_params_t {name} = {{{{ {name}_ring, {name}_dcomp, {name}_b, {m_1}, {m_2}, {l}, {lext}, {kmsis}, {name}_Bsq, {omega}, {omega_bits}, {eta}, {name}_sigma_1, {ceil(mp.log(sigma_1,2))}, {name}_sigma_2, {ceil(log(sigma_2,2))}, {name}_frak_s1, {ceil(mp.log(frak_s_1,2))}, {name}_frak_s2, {ceil(mp.log(frak_s_2,2))}}}}};

static const rf_abdlop_params_t {name} = {{{{ {name}_ring, {name}_dcomp, {name}_b, {m_1}, {m_2}, {0}, {lext}, {kmsis}, {name}_Bsq, {omega}, {omega_bits}, {eta}, {name}_sigma_1, {ceil(mp.log(sigma_1,2))}, {name}_sigma_2, {ceil(log(sigma_2,2))}, {name}_frak_s1, {ceil(mp.log(frak_s_1,2))}, {name}_frak_s2, {ceil(mp.log(frak_s_2,2))}}}}};

"""



printc(out)



sys.exit(int(0))

# Original scripts and proofs are coming from :

# [1] Lattice-Based Zero-Knowledge Proofs Under a Few Dozen Kilobytes

# https://doi.org/10.3929/ethz-b-000574844