diff --git a/spec/data_flow_presentation_create_presentation.md b/spec/data_flow_presentation_create_presentation.md index d852ef3..ce2446d 100644 --- a/spec/data_flow_presentation_create_presentation.md +++ b/spec/data_flow_presentation_create_presentation.md @@ -658,31 +658,51 @@ used as input to the generate presentation process. ##### Non-Revocation Proof Generation Steps -Given the data collected by the [[ref: holder]] to produce the NRP, the -following calculations are performed. +Init proof generation: +- Load issuer’s public revocation key $p = (h, h_1, h_2, \tilde{h}, \hat{h}, u, pk, y)$ +- Load the non-revocation credential $C_{NR} \leftarrow (I_A, \sigma, c, s, wit_i, g_i, g'_i, i)$ +- Obtain recent V, acc (from Verifier, Sovrin link, or elsewhere). +- Update $C_{NR}$: +$$ w \leftarrow w. \frac{\prod_{j \in V \backslash V_{old}} g'_{L+1-j+i}}{\prod_{j \in V_{old} \backslash V} g'_{L+1-j+i}} $$ +Here $V_{old}$ is taken from $wit_i$ and updated there. +- Select random $\rho, \rho' , r, r' , r'' , r''' , o, o'\ mod\ q$; +- Compute: +$$ E \leftarrow h_{ρ}\tilde{h^o}$$ +$$ D \leftarrow g^r\tilde{h}^{o'} $$ +$$ A \leftarrow \sigma\tilde{h}^\rho $$ +$$ \mathcal{G} \leftarrow g_i\tilde{h}^r $$ +$$ \mathcal{W} \leftarrow w\hat{h}^{r'} $$ +$$ \mathcal{S} \leftarrow \sigma _i\hat{h}^{r''} $$ +$$ \mathcal{U} \leftarrow u_i\hat{h}^{r'''} $$ +and adds these values to $\mathcal{C}$ +- Generate random $\tilde{\rho}, \tilde{o}, \tilde{o'}, \tilde{c}, \tilde{m}, \tilde{m'}, \tilde{t}, \tilde{t'}, \tilde{m_2}, \tilde{s}, \tilde{r}, \tilde{r'}, \tilde{r''}, \tilde{r'''}$ +- Compute: +$$ \bar{T_1} \leftarrow h^{\tilde{\rho}} \tilde{h} ^ {\tilde{o}} $$ +$$ \bar{T_2} \leftarrow E^{\tilde{c}}h^{-\tilde{m}}\tilde{h}^{-\tilde{t}} $$ +$$ \bar{T_3} \leftarrow e(A,\hat{h})^{\tilde{c}}.e(\tilde{h}, \hat{h})^{\tilde{r}}.e(\tilde{h}, y)^{-\tilde{\rho}}.e(\tilde{h}, y)^{-\tilde{m}}.e(\tilde{h}, y)^{-\tilde{m_2}}.e(\tilde{h}, y)^{-{\tilde{s}}} $$ +$$ \bar{T_4} \leftarrow e(\tilde{h}, acc)^{\tilde{r}}.e(1/g, \hat{h})^{\tilde{r'''}} $$ +$$ \bar{T_5} \leftarrow g^{\tilde{r}}\tilde{h}^{\tilde{o'}}$$ +$$ \bar{T_6} \leftarrow D^{\tilde{r''}}g^{-\tilde{m'}}\tilde{h}^{-\tilde{t'}} $$ +$$ \bar{T_7} \leftarrow e(pk. \mathcal{G}, \hat{h})^{\tilde{r''}}.e(\tilde{h}, \hat{h})^{-\tilde{m'}}.e(\tilde{h}, \mathcal{S})^{\tilde{r}} $$ +$$ \bar{T_8} \leftarrow e(\tilde{h}, u)^{\tilde{r}}.e(1/g, \hat{h})^{\tilde{r'''}} $$ +and add these values to $\mathcal{T}$. +- For non-revocation credential $C_{NR}$ compute: +$$ \widehat{\rho} \leftarrow \widetilde{\rho} - c_H\rho\bmod{q} $$ +$$ \widehat{o} \leftarrow \widetilde{o} - c_H\cdot o\bmod{q} $$ +$$ \widehat{c} \leftarrow \widetilde{c} - c_H\cdot c\bmod{q} $$ +$$ \widehat{o'} \leftarrow \widetilde{o'} - c_H\cdot o'\bmod{q} $$ +$$ \widehat{m} \leftarrow \widetilde{m} - c_H m\bmod{q} $$ +$$ \widehat{m'} \leftarrow \widetilde{m'} - c_H m'\bmod{q} $$ +$$ \widehat{t} \leftarrow \widetilde{t} - c_H t\bmod{q} $$ +$$ \widehat{t'} \leftarrow \widetilde{t'} - c_H t'\bmod{q} $$ +$$ \widehat{m_2} \leftarrow \widetilde{m_2} - c_H m_2\bmod{q} $$ +$$ \widehat{s} \leftarrow \widetilde{s} - c_H s\bmod{q} $$ +$$ \widehat{r} \leftarrow \widetilde{r} - c_H r\bmod{q} $$ +$$ \widehat{r'} \leftarrow \widetilde{r'} - c_H r'\bmod{q} $$ +$$ \widehat{r''} \leftarrow \widetilde{r''} - c_H r''\bmod{q} $$ +$$ \widehat{r'''} \leftarrow \widetilde{r'''} - c_H r'''\bmod{q}. $$ +and add them to $\mathcal{X}$. -Once the witness (`u`), the accumulator from the ledger (`e`) and the value of -the tails file entry for the credential of interest (`b`) are known, the NRP can -be generated as follows: - -::: todo - -To Do: Add more detail about the calculation of `C``u` and -`C``b` in the following. - -::: - -- The [[ref: holder]] calculates `u*b = e`, where e is the accumulator. -- The [[ref: holder]] derives two values (in cryptograhic terms - - [commitments](https://en.wikipedia.org/wiki/Commitment_scheme)) - `C``u` and `C``b` based on `u` and `b`. -- The [[ref: holder]] then calculates `T` from `C``u` and - `C``b` and sends all three to the [[ref: verifier]]. -- The [[ref: verifier]] uses `e` (the accumulator from the ledger), - `C``u` and `C``b` to calculate its own `T'` and confirms - that `T` and `T'` are the same. - -This is the zero knowledge non-revocation proof. Each NRP is added alongside the credential to which the NRP is applied, to the presentation generated by the [[ref: holder]] using this data @@ -720,33 +740,29 @@ model: The values in the data model are: -:::todo -To Do: Enumerate each of the items in each NRP section of the presentation. -::: - -- `x_list`" is ... - - `rho`" is ... - - `r`" is ... - - `r_prime`" is ... - - `r_prime_prime`" is ... - - `r_prime_prime_prime`" is ... - - `o`" is ... - - `o_prime`" is ... - - `m`" is ... - - `m_prime`" is ... - - `t`" is ... - - `t_prime`" is ... - - `m2`" is ... - - `s`" is ... - - `c`" is ... -- `c_list`" is ... - - `e`" is ... - - `d`" is ... - - `a`" is ... - - `g`" is ... - - `w`" is ... - - `s`" is ... - - `u`" is ... +- `x_list` is the list of the schnorr proofs. + - `rho` is the value of $\widehat{\rho}$ + - `r` is the value of $\widehat{r}$ + - `r_prime` is the value of $\widehat{r'}$ + - `r_prime_prime` is the value of $\widehat{r''}$ + - `r_prime_prime_prime` is the value of $\widehat{r'''}$ + - `o` is the value of $\widehat{o}$ + - `o_prime` is the value of $\widehat{o'}$ + - `m` is the value of $\widehat{m}$ + - `m_prime` is the value of $\widehat{m'}$ + - `t` is the value of $\widehat{t}$ + - `t_prime` is the value of $\widehat{t}$ + - `m2` is the value of $\widehat{m_2}$ + - `s` is the value of $\widehat{s}$ + - `c` is the value of $\widehat{c}$ +- `c_list` is the list of commitments. + - `e` is the value of $E$ + - `d` is the value of $D$ + - `a` is the value of $A$ + - `g` is the value of $\mathcal{G}$ + - `w` is the value of $\mathcal{W}$ + - `s` is the value of $\mathcal{S}$ + - `u` is the value of $\mathcal{U}$ As well, in the presentation data model, added to the `identifiers` item, is the timestamp (Unix epoch format) of the [[ref: RevRegEntry]] used to construct the NRP