zengo-x / zk-paillier

A collection of Paillier cryptosystem zero knowledge proofs

Zero Knowledge Paillier

This library contains a collection of Paillier cryptosystem zero knowledge proofs written in Rust. Each proof can be used as a stand alone proof but usually it will be used as part of another protocol. For each proof we state in comments what are the security assumptions required. Pay special attention to proofs that require more assumptions than just DCRA which is the assumption used in Paillier cryptosystem.

Currently implemented proofs

• Proof that a ciphertext encrypts zero
• Proof of knowledge of plaintext (correctness of ciphertext)
• Proof of correct paillier keypair generation
• Non-interactive proof of correct paillier keypair generation
• Range proof that a paillier ciphertext lies in interval [0,q]
• Non-interactive range proof that a paillier ciphertext lies in interval [0,q]
• Proof of correct opening of a ciphertext
• Proof that a ciphertext encrypts a message from a given message space
• Witness Indistinguishable Proof of knowledge of discrete log with composite modulus
• NI Proof of plaintext multiplication: ciphertexts e_a = Enc(a), e_b = Enc(b), e_c = Enc(c) such that ab = c mod n
• NI proof of linear relation between several plaintexts of several known ciphertexts

Usage

There is no unified API at the moment, please follow the test attached to each proof for example usage.

Legacy

Rust-paillier was orignally a library that implemented the basic Paillier cryptosystem with main contributors from Snips. Catalyzed by KZen needs for paillier zero knowledge proofs the original library was forked and another layer of proofs was added. As more and more zk-proofs were being added we realized that the base paillier cryptosystem layer is at a point of stability and only minor changes are required once in a while where on the other hand the second layer of zk-proofs are evolving at a much faster pace and the code should be considered more experimental. At this point we agreed to divide the library to the base layer (rust-paillier) and zk-paillier which is the current library.

Finally. we would like to thank Morten Dahl,lead maintainer of rust-paillier and KZen advisor. another thank you goes to Pascal Paillier.

Development Process

the Rust utilities wiki contains information on workflow and environment set-up.

Feel free to reach out or join the KZen Research Telegram for discussions on code and research.

License

zk-paillier is released under the terms of the GPL-3.0 license. See LICENSE for more information.

Contact

Feel free to reach out or join the KZen Research Telegram for discussions on code and research.

zk-paillier's Issues

Perhaps add the exact section - 6.2.3

https://github.com/KZen-networks/zk-paillier/blob/635e1963cdfe84a873ba97b8bb81da580f947420/src/zkproofs/correct_key_ni.rs#L24

Also, somewhere it should be mentioned that they implicitly use gcd(n,phi(n))>1 ==> raising to power n is not a permutation on Z_n

Build fails on msvc (error w/ LINK)

Using rust x86_64-pc-windows-msvc 1.42 nightly

After cloning vanilla zk-paillier, and then trying to run a test in correct_key.rs, I get this error:

error: linking with `link.exe` failed: exit code: 1181
  |
  = note: "C:\\Program Files (x86)\\Microsoft Visual Studio\\2019\\Community\\VC\\Tools\\MSVC\\14.21.27702\\bin\\HostX64\\x64\\link.exe" "/NOLOGO" "/NXCOMPAT" "/LIBPATH:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.114v3gikb4awckxa.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.12yn05zcoymgr6xm.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.1gyten4w8dvon2zp.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.1px2od1nam2mdjff.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.1tojsarasnjwrt29.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.1wg3bamhvejq4ng.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.21cshchx9kjzf9uf.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.220jetlx7obra1qm.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2292n5v63xuzdt6h.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2dcgho96r6cyzdz0.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2i8erytijvhbomq7.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2o0mzrdce8efepvy.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2tlvbfpukzq1ftpg.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2xinwogfwlg76bsx.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.2xzixahpfdcvnuxx.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.30fb7x2o534x641v.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.382d68969wjvpvmt.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.39f5kr7o9ad24k29.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3bv1swjsrxzpimbk.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3eu12950l19x07pc.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3goxvfhmg1gkqqcr.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3ijj6cw19xl50zid.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3kcy1lzaatnmmol3.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3o6dlrz7kz9s69jp.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3rxm6fnwxc00en9g.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.3xhlm88dge046yri.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.403k1o8spcxj8vom.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.40wi14drxlxljcat.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.41jhfhihlc48s4mk.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.42dkyb1n0htl2euz.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.43fixt1bqym6igy9.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.49549a79aztw91vt.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4agigz5r6v1icamz.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4eifyg1ig6einfe3.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4ff9bvbbumirab18.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4krap5s4rtb1z5xn.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4lf0v9wh5gcfium0.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4nyznwbdsqqblvk4.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4qkiilkxxkd6proy.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4v8ioe69nzrrtmks.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.4xkpepdrdtb9hegd.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.50hrkscg3tgt360u.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.58prn9kmiiiwi16h.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.5cw5r9dpzb9fihra.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.5eoz8rfsa0ynh1ve.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.5g7cm4g7k3lixc0v.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.6sakb6zoy05b0yp.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.9jch6zxulz1so4s.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.adexyiz742n3aay.rcgu.o" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.v33fofezt961mjh.rcgu.o" "/OUT:C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.exe" "C:\\hyxe_wave\\target\\debug\\examples\\simple_voting.pcuzk76gfoypp75.rcgu.o" "/OPT:REF,NOICF" "/DEBUG" "/NATVIS:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\etc\\intrinsic.natvis" "/NATVIS:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\etc\\liballoc.natvis" "/NATVIS:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\etc\\libcore.natvis" "/NATVIS:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\etc\\libstd.natvis" "/LIBPATH:C:\\hyxe_wave\\target\\debug\\deps" "/LIBPATH:C:\\hyxe_wave\\target\\debug\\build\\ring-be30b89f0b619bcc\\out" "/LIBPATH:C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib" "C:\\hyxe_wave\\target\\debug\\deps\\libserde_json-da937ce24d9dd3d4.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libryu-7d7bfd334e48f5e0.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libitoa-1c78f34c0ced9ebe.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libpaillier-d293a81ff2f074dd.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libgmp-cb817d4fbe422080.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\liblibc-e64a90d38dbfe495.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libtest-443b9fb43a01b194.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libterm-85bf561df9fb28bd.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libgetopts-7981ea95e29bb01d.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libunicode_width-cb90f8888e8171f3.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\librustc_std_workspace_std-49a10b87ef4d1c53.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libserde-8f9c2e2e9a828b90.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libring-31091ad4255d4a18.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libuntrusted-31b6dc00d1618ef8.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\librayon-555ada12927a3001.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\librayon_core-24191fe220dac309.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libnum_cpus-ab9206cc743f0462.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libcrossbeam_queue-7986cd3c604d95e4.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libcrossbeam_deque-6b3c373a9b29cfc6.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libcrossbeam_epoch-4568d4b3d5168467.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libscopeguard-a129e2008205fd8a.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libmemoffset-84c7ae62eaed872a.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libcrossbeam_utils-6f84d923972d5a07.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\liblazy_static-9e7a4d7abb5a61c1.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libmaybe_uninit-f7b3815591794411.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libcfg_if-64e9234d16957a03.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libeither-967709d550b26e39.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\librand-966f8ef0e17babce.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libwinapi-9171be342221d4d7.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\librand_core-62e3b0263e659697.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\librand_core-9af8045a0bc19588.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libnum_traits-dd0d30d5d579384f.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libnum_traits-819a6cdda0c56747.rlib" "C:\\hyxe_wave\\target\\debug\\deps\\libbit_vec-3f8e51c50471f5dc.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libstd-d2a75bc74b11e2cc.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libpanic_unwind-915bfcc230c4eda6.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libhashbrown-2d959e942a9e3e5c.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\librustc_std_workspace_alloc-d889c9534777e0f9.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libbacktrace-c0632338fc51212a.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\librustc_demangle-c23d6f351d09fb94.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libunwind-2098d630f29dcc07.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libcfg_if-68cf5df90ef019f9.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\liblibc-744c9ad3b176c572.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\liballoc-f60261e32bf289cf.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\librustc_std_workspace_core-2ef81bd49a7650fd.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libcore-5779894fffb6f902.rlib" "C:\\Users\\tbrau\\.rustup\\toolchains\\nightly-x86_64-pc-windows-msvc\\lib\\rustlib\\x86_64-pc-windows-msvc\\lib\\libcompiler_builtins-7b6566d5f1691e05.rlib" "gmp.lib" "gmp.lib" "gmp.lib" "gmp.lib" "gmp.lib" "kernel32.lib" "advapi32.lib" "advapi32.lib" "credui.lib" "kernel32.lib" "secur32.lib" "advapi32.lib" "ws2_32.lib" "userenv.lib" "msvcrt.lib"
  = note: LINK : fatal error LNK1181: cannot open input file 'gmp.lib'

I've tried cloning rust-gmp, and then linking the subcrait's rust-gmp dependency towards the cloned/local rust-gmp, but the error persisted. At this point, I'm not sure if the error is on my side, or somewhere else

make salt a configurable system parameter in correct_key_ni

https://github.com/KZen-networks/zk-paillier/blob/24c522a239de04366c0ebf08d703e16b67edc8ef/src/zkproofs/correct_key_ni.rs#L31

Write now it is the bytes of "kzen".

we would like to have a method to set the salt and to document the presence of the said salt.

add travis support

The problem of scope proof failure

The proof generated by RangeProofNi sometimes fails, try to loop many times, and some of the proof results are false

zero knowledge proof for correct message

In the case that the message space size is small (a message can be only one of a few possibilities ), it is possible to create a "ring" like structure that proves that the encrypted value is a message from the message space without revealing the message.
Reference: https://paillier.daylightingsociety.org/Paillier_Zero_Knowledge_Proof.pdf

How to prove a num less than 0?

I want to use zk-paillier range proof to prove a secret num less or more than 0.I noticed the comment "Zero-knowledge range proof that a value x<q/3 lies in interval [0,q]." in the code.So I must design a algorithms to meet the logic:
if x < 0 then
x' < q/3
else
x' > 2q/3
My simple algorithms is as below:
if x%3 == 0
x' = 2/3q + 1/3q*(x+2)%3
else
x' = 2/3q + 1/3q*x%3
But it's too hard to verify because verifier need to verify the encrpt relationship between x and x' at first.
Is there any better way?
Any suggestion would be appreciated!

make sure `mask_generation` sampling avoids modulo bias

zk-paillier/src/zkproofs/correct_key_ni.rs

Line 112 in e3e3435

let msklen = out_length / DIGEST_SIZE + 1; // adding one sha256 is more efficient then rejection sampling (see A.4 (e) in the paper)

(thanks to JP an team who raised this concern)

move all use of BigInt operations to be done through curv library

Currently some operations are using BigInt type from rust-paillier and some operations are using BigInt type from curv. This can lead only to bad results. curv's BigInt is maintained closely (will continue to be with future version of rust-gmp) and supports all operations that are in rust-paillier. we suggest to rely only on this BigInt.

zero-knowledge proof for correct construction of ciphertext

To prove a ciphertext is constructed correctly such that :
C = Enc(m,r) = g^m r^N mod N^2

1. Verifier commits to a random string com(e) of length t bits
2. Prover creates t encryptions using {m_i , r_i} and sends to the Verifier the vector of encryptions [C_1,...,C_t]
3. Verifier decommits to e
   4.1) if e_i = 0: the Prover sends {m_i , r_i}
   4.2) if e_i= 1: the Prover sends {m', r'} = {m + m_i, r*r_i}
4. Verifier checks C_i = Enc{m_i, r_i} for zero bits and Enc(m', r') = C*C_i otherwise

C is constructed correctly with probability 1-1/2^t

implement zeroize for proofs

I noticed that some proofs require zeroizing secret data after use. For example: https://github.com/ZenGo-X/zk-paillier/blob/master/src/zkproofs/multiplication_proof.rs

Dependecy error

Hi, I'm trying to use this library, but I get this error:

podman run --rm -it --name rust-cargo docker.io/rust:1.23.0 bash

root@e8ab53f47c1f:/usr/src# git clone https://github.com/ZenGo-X/zk-paillier.git
Cloning into 'zk-paillier'...
remote: Enumerating objects: 511, done.
remote: Counting objects: 100% (102/102), done.
remote: Compressing objects: 100% (41/41), done.
remote: Total 511 (delta 81), reused 65 (delta 61), pack-reused 409
Receiving objects: 100% (511/511), 127.45 KiB | 0 bytes/s, done.
Resolving deltas: 100% (333/333), done.
root@e8ab53f47c1f:/usr/src# cd zk-paillier/
root@e8ab53f47c1f:/usr/src/zk-paillier# cargo test test_verifier_for_correct_proof
warning: unused manifest key: dependencies.paillier.package
warning: unused manifest key: package.edition
    Updating registry `https://github.com/rust-lang/crates.io-index`
error: no matching version `^0.4.3` found for package `paillier` (required by `zk-paillier`)
location searched: registry `https://github.com/rust-lang/crates.io-index`
versions found: 0.2.0, 0.1.7, 0.1.6, ...

How can I fix this?

It's my first time in Rust, sorry if this is a basic error.