Struct ProverState 

pub struct ProverState<H = StdHash, R = StdRng>
where
    H: DuplexSpongeInterface,
    R: RngCore + CryptoRng,
{
    pub duplex_sponge_state: H,
    /* private fields */
}

ProverState is the prover state in the non-interactive transformation.

It provides the secret coins of the prover for zero-knowledge, and the hash function state for the verifier’s public coins.

The internal random number generator is instantiated with sha3::Shake128, seeded via rand::rngs::StdRng.

Safety

Leaking ProverState is equivalent to leaking the prover’s private coins, and therefore zero-knowledge. ProverState does not implement Clone or Copy to prevent accidental state-restoration attacks.

Fields

duplex_sponge_state: H

The public coins for the protocol.

Safety

Copying this object will break the soundness guarantees installed at the ProverState level.

Implementations

impl<H, R> ProverState<H, R>

where H: DuplexSpongeInterface, R: RngCore + CryptoRng,

pub const fn rng(&mut self) -> &mut ReseedableRng<R>

Returns the reseedable RNG bound to this transcript.

pub const fn narg_string(&self) -> &[u8]

Returns the current serialized NARG string.

pub fn public_message<T: Encoding<[H::U]> + ?Sized>(&mut self, message: &T)

Input a public message to the Fiat–Shamir transformation.

A public message in this context is a message that is shared among prover and verifier outside of the NARG, and is to be included in the Fiat–Shamir transformation but not in the final NARG string.

use spongefish::ProverState;

let mut prover_state = spongefish::domain_separator!("examples"; "ProverState::public_message")
    .instance(&0u32)
    .std_prover();
prover_state.public_message(&123u32);
assert_eq!(prover_state.narg_string(), b"");

pub fn prover_message<T: Encoding<[H::U]> + NargSerialize + ?Sized>( &mut self, message: &T, )

Input a prover message of type T into the Fiat–Shamir transformation.

T must implement Encoding<[H::U]> to be encoded in the domain of the duplex sponge, and NargSerialize to be serialized into the NARG string.

use spongefish::ProverState;

let mut prover_state = spongefish::domain_separator!("examples"; "ProverState::prover_message")
    .instance(&0u32)
    .std_prover();
prover_state.prover_message(&42u32);
let expected = 42u32.to_le_bytes();
assert_eq!(prover_state.narg_string(), expected.as_slice());

pub fn verifier_message<T: Decoding<[H::U]>>(&mut self) -> T

Returns a verifier message T that is uniformly distributed.

T must implement Decoding<[H::U]>.

pub const fn transcript(&self) -> &[u8]

👎Deprecated:

Please use ProverState::narg_string instead.

Alias for narg_string.

pub fn challenge<T: Decoding<[H::U]>>(&mut self) -> T

👎Deprecated:

Please use ProverState::verifier_message instead.

Alias for verifier_message.

pub fn public_messages<T: Encoding<[H::U]>>(&mut self, messages: &[T])

Input to the Fiat–Shamir transformation an array of public messages.

pub fn public_messages_iter<J>(&mut self, messages: J)

where J: IntoIterator, J::Item: Encoding<[H::U]>,

Input to the Fiat–Shamir transformation an iterator of public messages.

pub fn prover_messages<T: Encoding<[H::U]> + NargSerialize>( &mut self, messages: &[T], )

Absorbs a list of prover messages at once.

pub fn prover_messages_iter<J>(&mut self, messages: J)

where J: IntoIterator, J::Item: Encoding<[H::U]> + NargSerialize,

Absorbs an iterator of prover messages.

pub fn verifier_messages<T: Decoding<[H::U]>, const N: usize>( &mut self, ) -> [T; N]

Returns a fixed-length array of uniformly-distributed verifier messages [T; N].

pub fn verifier_messages_vec<T: Decoding<[H::U]>>( &mut self, len: usize, ) -> Vec<T>

Returns a vector of uniformly-distributed verifier messages [T; N].

Trait Implementations

impl<H, R> Debug for ProverState<H, R>

where H: DuplexSpongeInterface, R: RngCore + CryptoRng,

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<H: DuplexSpongeInterface + Default, R: RngCore + CryptoRng + SeedableRng> Default for ProverState<H, R>

Available on crate feature yolocrypto only.

Creates a new ProverState seeded using rand::SeedableRng::from_entropy.

Default provides alternative initialization methods than the one via DomainSeparator. ProverState::default is only available with the yolocrypto feature and its support in future releases is not guaranteed.

fn default() -> Self

Returns the “default value” for a type.

impl<H: DuplexSpongeInterface, R: RngCore + CryptoRng + SeedableRng> From<H> for ProverState<H, R>

Creates a new ProverState using the given duplex sponge interface.

fn from(value: H) -> Self

Converts to this type from the input type.