coleleavitt/opaque-lattice
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proofs

Browse Source
This commit is contained in:
Cole Leavitt
2026-01-06 12:55:40 -07:00
parent dfa968ec7d
commit 0099a6e1fb
3 changed files with 1419 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/oprf/mod.rs
View File

@@ -3,6 +3,8 @@ pub mod hybrid;
pub mod ot; pub mod ot;
pub mod ring; pub mod ring;
pub mod ring_lpr; pub mod ring_lpr;
#[cfg(test)]
mod security_proofs;
pub mod voprf; pub mod voprf;
pub use ring::{ pub use ring::{

1407
src/oprf/security_proofs.rs Normal file
View File

File diff suppressed because it is too large Load Diff

14
src/oprf/voprf.rs
View File

@@ -66,8 +66,15 @@ pub const COMMITMENT_LEN: usize = 32;
const CHALLENGE_LEN: usize = 16; const CHALLENGE_LEN: usize = 16;
/// Maximum L∞ norm for response coefficients (for rejection sampling) /// Maximum L∞ norm for response coefficients (for rejection sampling)
/// Must be large enough to hide k but small enough for security /// z = m + e*k where m in [-MASK_BOUND, MASK_BOUND], e*k in [-48, 48]
const RESPONSE_BOUND: i32 = 32; /// RESPONSE_BOUND must be > MASK_BOUND + 48 for high acceptance probability
const RESPONSE_BOUND: i32 = 128;
/// Mask sampling bound - must be large enough to statistically hide e*k
/// For ZK: mask_bound >> challenge_scalar * key_bound
/// challenge_scalar <= 16, key coeffs in [-3,3], so e*k <= 48
/// We use mask_bound = 64 so z is usually in [-112, 112] < RESPONSE_BOUND
const MASK_BOUND: i32 = 64;
/// Number of rejection sampling attempts before giving up /// Number of rejection sampling attempts before giving up
const MAX_REJECTION_ATTEMPTS: usize = 256; const MAX_REJECTION_ATTEMPTS: usize = 256;
@@ -377,8 +384,7 @@ pub fn generate_proof<R: RngCore>(
// Try to generate proof with rejection sampling // Try to generate proof with rejection sampling
for _attempt in 0..MAX_REJECTION_ATTEMPTS { for _attempt in 0..MAX_REJECTION_ATTEMPTS {
// Step 1: Sample random mask m with small coefficients let mask = random_small_ring(rng, MASK_BOUND);
let mask = random_small_ring(rng, RESPONSE_BOUND / 2);
let mask_unsigned = signed_to_unsigned(&mask); let mask_unsigned = signed_to_unsigned(&mask);
// Step 2: Compute mask commitment t = H(m || m·a) // Step 2: Compute mask commitment t = H(m || m·a)