Verifier.cc

// Copyright 2025 Fondazione LINKS

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at

//     http://www.apache.org/licenses/LICENSE-2.0

// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include "Verifier.h"


//==============================================================================
// V_Verify     -    Verifier.Verify function
// 
// Inputs:
// - VP:             structure with the Verifiable Presentation
// - nonce:          random cryptographic nonce (challenge) generated by Verifier
// - seed_crs:       initial public seed for crs structure
// - crs:            structure with the pair (crs_ISIS, crs_Com), generated by Hcrs
// - B_f:            public random matrix B_f ∈ Z^(nd×t)_q
// - idx_pub:        indexes of disclosed attributes (revealed)
// 
// Output:
// -  1 or 0:        accept if π is valid, reject if the proof is invalid
//==============================================================================
long V_Verify(VP_t& VP, const uint8_t* nonce, const uint8_t* seed_crs, const CRS2_t& crs, const mat_zz_p& B_f, const vec_UL &idx_pub)
{
    // NOTE: assuming that current modulus is q0 (not q_hat)
    ulong           i, j, k;
    IPK_t           ipk;
    long            out, mul;
    vec_zz_pX       a;
    vec_ZZ          m_i, coeffs_m;
    mat_zz_p        P, C, C0, C1; 
    vec_zz_p        coeffs_m_idx;
    vec_ZZ          Bounds;

    const ulong     num_idx_pub = idx_pub.length();     // Number of disclosed attributes (revealed)
    const vec_UL    idx_hid = Compute_idx_hid(idx_pub); // Indexes of undisclosed attributes (hidden)
    const ulong     idxhlrd = (idx_hid.length() * h0) + (lr0 * d0); //|idx_hid|·h + ℓr·d
    const ulong     m2d     = (m0 + 2)*d0;    // (m+2)·d
    const ulong     lmlrd   = (lm0 + lr0)*d0; // (ℓm+ℓr)·d


    #ifdef USE_REVOCATION
        // Check if the attribute with the timestamp contains the current date/time
        if ( VP.attrs_prime[IDX_TIMESTAMP] != Get_timestamp(1) )
        {
            cout << "\n  Credential EXPIRED!" << endl;
            return 0;
        }
    #endif

    
    // 1. (a′_1, ··· , a′_ℓ) ← attrs′,   a′_i ∈ {0, 1}∗
    // NOTE: l0 = |idx_hid| + |idx_pub| = len(attrs),  d0 must divide l0*h0
    
    // 2. (a1, a2, c0, c1) ← ipk,   ipk ∈ R_q × R^m_q × R^(ℓm)_q × R^(ℓr)_q
    CompleteIPK(ipk, VP.ipk_bytes);
    
    // 3. m′ ← Coeffs^−1(H_M(a′_1), ... , H_M(a′_ℓ)) ∈ R^ℓm_q
    coeffs_m.SetLength(l0 * h0);
    k = 0;

    for(i=0; i<l0; i++)
    {
        // a_i = VP.attrs_prime[i];
        HM(m_i, VP.attrs_prime[i]);
        
        for(j=0; j<h0; j++)     
        {
            coeffs_m[k] = m_i[j];
            k++;
        }
    }
    // NOTE: coeffs_m is directly used instead of mex


    // a ← [1|a1|a2^T]  
    a.SetLength(m0+2);
    
    a[0].SetLength(d0);
    a[0] = zz_pX(1);  
       
    a[1] = ipk.a1;

    for(i=0; i<m0; i++)
    {
        a[2+i] = ipk.a2[i];
    } 
          
          
    // 4. P ← rot([1|a1|a2^T]) = rot(a),   P ∈ Z^(d×(m+2)d)_q
    P.SetDims(d0, (m2d + d_hat)); 
    // NOTE: zero padding of P (d_hat columns) anticipated here, from Verify_ISIS
    rot_vect(P, a);


    // 5. C ← [rot(c0^T)_(idx_pub) | rot(c0^T)_(idx_hid) | rot(c1^T)],   C ∈ Z_q^(d × (ℓm+ℓr)d)
    C.SetDims(d0, (lmlrd + d_hat));
    // NOTE: zero padding of C (d_hat columns) anticipated here, from Verify_ISIS

    C0.SetDims(d0, lm0*d0);
    rot_vect(C0, ipk.c0);

    // NOTE: first copy in C the columns for disclosed attributes, then those for undisclosed attributes
    // NOTE: lm0*d0 = l0*h0 = (|idx_hid| + |idx_pub|) * h0       
    k = 0;

    for(auto &idx: idx_pub)
    {
        for(j=(idx*h0); j<((idx+1)*h0); j++)
        {
            for(i=0; i<d0; i++)
            {   
                C[i][k] = C0[i][j];
            }
            k++;
        }
    }
   
    for(auto &idx: idx_hid)
    {
        for(j=(idx*h0); j<((idx+1)*h0); j++)
        {
            for(i=0; i<d0; i++)
            {   
                C[i][k] = C0[i][j];
            }
            k++;
        }
    }

    C0.kill(); 

    C1.SetDims(d0, lr0*d0);
    rot_vect(C1, ipk.c1);

    for(j=0; j<(lr0*d0); j++)
    {
        for(i=0; i<d0; i++)
        {   
            C[i][k] = C1[i][j];
        }
        k++;
    }

    C1.kill();

  
    // 6. m' ← Coeffs(m')_(idx_pub),   m' ∈ Z_q^(idx_pub·h)
    coeffs_m_idx.SetLength(num_idx_pub * h0);
    k = 0;

    for(auto &idx: idx_pub)
    {
        for(i=(idx*h0); i<((idx+1)*h0); i++)
        {
            coeffs_m_idx[k] = conv<zz_p>(coeffs_m[i]);
            k++;
        }
    }


    // 7. Bounds ← ( sigma0·√((m + 2)d), ψ·√(h·|idx| + ℓr·d) ),    Bounds ∈ Z^2
    Bounds.SetLength(2);
    Bounds[0] = ZZ(sigma2) * ZZ((m0+2)*d0);
    Bounds[1] = sqr(ZZ(psi0)) * ZZ(idxhlrd);
    // NOTE: squared Bounds, values in ZZ


    // 8. return  Verify^HISIS_ISIS( crs_ISIS, (ˆq2/q·P, ˆq2/q·C, m′, ˆq2/q·Bf, Bounds, idx), VP.pi )
    if (not(divide( ZZ(q2_hat), q0)))
    {
        cout << " ERROR: q2_hat must be divisible by q! " << endl;
    }

    mul = long(q2_hat) / long(q0);

    {
        zz_pPush push(q2_hat);
        // NOTE: backup current modulus q0, temporarily set to q2_hat (i.e., zz_p::init(q2_hat)) 

        out = Verify_ISIS(nonce, seed_crs, crs[0], VP.ipk_bytes, (mul * P), (mul * C), coeffs_m_idx, (mul * B_f), Bounds, num_idx_pub, &(VP.Pi), idx_hid); 
        // NOTE: P, C, B_f are converted from modulo q0 to q2_hat
    }

    P.kill();
    C.kill();

    return out;
}