diff --git a/static/js/modules/interface/proofs.js b/static/js/modules/interface/proofs.js index 68820b8..4694a12 100644 --- a/static/js/modules/interface/proofs.js +++ b/static/js/modules/interface/proofs.js @@ -503,7 +503,6 @@ export function verifyFortify(obj, key) { let p = c.verifyNI(verification.zeroProofs[r]); if (p !== 0n) { - console.log(p); return false; } } diff --git a/whitepaper/Dissertation.pdf b/whitepaper/Dissertation.pdf index 1354b45..d6ba35f 100644 Binary files a/whitepaper/Dissertation.pdf and b/whitepaper/Dissertation.pdf differ diff --git a/whitepaper/Dissertation.tex b/whitepaper/Dissertation.tex index 0da43df..ce67bfc 100644 --- a/whitepaper/Dissertation.tex +++ b/whitepaper/Dissertation.tex @@ -65,6 +65,8 @@ % %\clearpage +\section{Disambiguation} + \begin{table}[htp] \begin{tabularx}{\textwidth}{c X} \toprule @@ -72,14 +74,15 @@ \\ \midrule $|a|$ & Bit length of value $a$ \\ - $\left(\frac{a}{b}\right)$ & Jacobi symbol for $a, b$ \\ - $\frac{a}{b}$ & Regular division \\ + $\left(\frac{a}{b}\right)$ & Jacobi symbol for $a, b$ or division (context dependent) \\ + $\frac{a}{b}$ & Division \\ $\mathbb{Z}_k$ & Additive group of integers modulo $k$ \\ $\mathbb{Z}^*_k$ & Multiplicative group of units modulo $k$ \\ $\gcd(a, b)$ & Greatest common divisor of $a, b$ \\ $\lcm(a, b)$ & Least common multiple of $a, b$ \\ $\phi$ & Euler's totient function \\ $\lambda$ & Carmichael's totient function \\ + $H(\dots)$ & Ideal cryptographic hash function \\ \bottomrule \end{tabularx} \end{table} @@ -736,7 +739,7 @@ Instead of proving a value is within a range, the prover will demonstrate that a \item Prover transmits $\{ (\psi(R_i), E(n_i, r_i^*)) \mid 0 < i \leq N \}$ where $\psi$ is a random bijection on the regions. \item Verifier chooses a random $c \in \{0, 1\}$. \begin{enumerate} - \item If $c = 0$, the verifier requests the definition of $\psi$. They then compute the product of the $E(x, r_i) \cdot E(x, r_i^*)$ and verify proofs that each of these is zero. + \item If $c = 0$, the verifier requests the definition of $\psi$. They then compute the product of the $E(x, r_i) \cdot E(x, r_i^*)$ and request proofs that each of these is zero. \item If $c = 1$, the verifier requests a proof that each $E(n_i, r_i^*)$ is as claimed. \end{enumerate} @@ -776,7 +779,7 @@ In practice, as we are using Jurik's form of Paillier, the best we can hope for \subsection{Proving fortifications} -More work is needed on point (5). The range proof alone only works to prevent negative values from appearing in a fortify action. Fortify actions need to be of form $\{ k, -k, 0, \dots, 0 \}$) and the regions corresponding to $k, -k$ amounts must be adjacent. +Point (5) still remains, as the range proof alone only works to prevent negative values from appearing in a fortify action. Fortify actions need to be of form $\{ k, -k, 0, \dots, 0 \}$) and the regions corresponding to $k, -k$ amounts must be adjacent. \begin{figure}[htp] \centering @@ -878,12 +881,12 @@ We combine some ideas from the graph isomorphism proofs with ideas from before t Run $t$ times in parallel: \begin{enumerate} - \item Prover transmits $\{ (\psi(R_i), E(n_i, r_i^*)) \mid 0 < i \leq N \}$ where $\psi$ is a random bijection on the regions. + \item Prover transmits $\{ (\psi(R_i), E(-n_i, r_i^*)) \mid 0 < i \leq N \}$ where $\psi$ is a random bijection on the regions, and $\{ H(R_i, R_j, s_{ij}) \mid R_i \text{ neighbours } R_j \}$ where $s_{ij}$ is a random salt. \item Verifier chooses a random $c \in \{0, 1\}$. \begin{enumerate} - \item If $c = 0$, the verifier requests the definition of $\psi$. They then compute the product of the $E(x, r_i) \cdot E(x, r_i^*)$ and verify proofs that each of these is zero. + \item If $c = 0$, the verifier requests the definition of $\psi$ and each salt. They check that the resulting graph is isomorphic to the original graph. They then compute $E(n_i, r_i) \cdot E(-n_i, r_i^*)$ for each $i$ and request a proof that each is zero. Finally, they compute each edge hash and check that there are precisely the correct number of hashes. - \item If $c = 1$, the verifier requests a proof that each $E(n_i, r_i^*)$ is as claimed. + \item If $c = 1$, the verifier requests proofs that $|S| - 2$ are zero and that the remaining pair add to zero. They then request the salt used to produce the hash along the edge joining the two non-zero elements, and test that this hash is correct. \end{enumerate} \end{enumerate} \end{protocol}