Skip to content

Commit 24e5a20

Browse files
AaronFeickertAaronFeickert
authored
Moves variable-time proving behind a feature gate (#103)
It can be risky to make variable-time prover functionality available. This PR moves it behind a feature gate. BREAKING CHANGE: Moves parts of the public API behind a feature gate.
1 parent fc3682c commit 24e5a20

File tree

6 files changed

+52
-50
lines changed

6 files changed

+52
-50
lines changed

‎Cargo.toml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ rand_chacha = { version = "0.3.1", default-features = false }
3131
default = ["rand", "std"]
3232
# Adds proof serialization and deserialization via [`borsh`](https://crates.io/crates/borsh)
3333
borsh = ["dep:borsh"]
34+
# Adds variable-time prover functionality that should only be used if you absolutely know what you're doing
35+
hazmat = []
3436
# Adds additional prover functionality that supplies a cryptographically-secure random number generator
3537
rand = ["rand_core/getrandom"]
3638
# Adds proof serialization and deserialization via [`serde`](https://crates.io/crates/serde)
@@ -41,10 +43,12 @@ std = ["blake3/std", "borsh?/std", "itertools/use_std", "merlin/std", "rand_core
4143
[[bench]]
4244
name = "triptych"
4345
harness = false
46+
required-features = ["hazmat"]
4447

4548
[[bench]]
4649
name = "parallel"
4750
harness = false
51+
required-features = ["hazmat"]
4852

4953
[[example]]
5054
name = "ringct"

‎README.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,14 @@ There are several features available.
3737
| Feature | Default? | Description |
3838
| :--- | :---: | :--- |
3939
| `borsh` | | Adds proof serialization and deserialization via [`borsh`](https://crates.io/crates/borsh) |
40-
| `serde` | | Adds proof serialization and deserialization via [`serde`](https://crates.io/crates/serde) |
40+
| `hazmat` | | Adds variable-time prover functionality that should only be used if you absolutely know what you're doing |
4141
| `rand` | ✓ | Adds additional prover functionality that supplies a cryptographically-secure random number generator |
42+
| `serde` | | Adds proof serialization and deserialization via [`serde`](https://crates.io/crates/serde) |
4243
| `std` | ✓ | Adds corresponding dependency features |
4344

4445
The underlying [curve library](https://crates.io/crates/curve25519-dalek) chooses an arithmetic backend based on CPU feature detection.
4546
Using a nightly compiler broadens the backend set, and may provide better performance.
46-
You can examine performance using the benchmarks: either `cargo bench` or `cargo +nightly bench`.
47+
You can examine performance using the benchmarks: either `cargo bench --all-features` or `cargo +nightly bench --all-features`.
4748

4849
Proofs support a custom serialization format designed to be efficient and canonical.
4950
This is used for `borsh` serialization and deserialization, or can be accessed directly.

‎src/lib.rs

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,15 @@
4141
//! | Feature | Default? | Description |
4242
//! | :--- | :---: | :--- |
4343
//! | `borsh` | | Adds proof serialization and deserialization via [`borsh`](https://crates.io/crates/borsh) |
44-
//! | `serde` | | Adds proof serialization and deserialization via [`serde`](https://crates.io/crates/serde) |
44+
//! | `hazmat` | | Adds variable-time prover functionality that should only be used if you absolutely know what you're doing |
4545
//! | `rand` | ✓ | Adds additional prover functionality that supplies a cryptographically-secure random number generator |
46+
//! | `serde` | | Adds proof serialization and deserialization via [`serde`](https://crates.io/crates/serde) |
4647
//! | `std` | ✓ | Adds corresponding dependency features |
4748
//!
4849
//! The underlying [curve library](https://crates.io/crates/curve25519-dalek) chooses an arithmetic backend based on CPU feature detection.
4950
//! Using a nightly compiler broadens the backend set, and may provide better performance.
50-
//! You can examine performance using the benchmarks: either `cargo bench` or `cargo +nightly bench`.
51+
//! You can examine performance using the benchmarks: either `cargo bench --all-features` or `cargo +nightly bench
52+
//! --all-features`.
5153
//!
5254
//! Proofs support a custom serialization format designed to be efficient and canonical.
5355
//! This is used for `borsh` serialization and deserialization, or can be accessed directly.

‎src/parallel/proof.rs

Lines changed: 22 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ impl TriptychProof {
9393
/// You must also supply a [`Transcript`] `transcript`.
9494
///
9595
/// This function specifically avoids constant-time operations for efficiency.
96-
#[cfg(feature = "rand")]
96+
#[cfg(all(feature = "rand", feature = "hazmat"))]
9797
pub fn prove_vartime(
9898
witness: &TriptychWitness,
9999
statement: &TriptychStatement,
@@ -113,6 +113,7 @@ impl TriptychProof {
113113
/// You must also supply a [`CryptoRngCore`] random number generator `rng` and a [`Transcript`] `transcript`.
114114
///
115115
/// This function specifically avoids constant-time operations for efficiency.
116+
#[cfg(feature = "hazmat")]
116117
pub fn prove_with_rng_vartime<R: CryptoRngCore>(
117118
witness: &TriptychWitness,
118119
statement: &TriptychStatement,
@@ -1143,7 +1144,7 @@ mod test {
11431144
}
11441145

11451146
#[test]
1146-
#[cfg(feature = "rand")]
1147+
#[cfg(all(feature = "rand", feature = "hazmat"))]
11471148
#[allow(non_snake_case, non_upper_case_globals)]
11481149
fn test_prove_verify_vartime() {
11491150
// Generate data
@@ -1158,6 +1159,7 @@ mod test {
11581159
}
11591160

11601161
#[test]
1162+
#[cfg(feature = "hazmat")]
11611163
#[allow(non_snake_case, non_upper_case_globals)]
11621164
fn test_prove_verify_vartime_with_rng() {
11631165
// Generate data
@@ -1183,9 +1185,8 @@ mod test {
11831185
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
11841186

11851187
// Generate and verify a proof
1186-
let proof =
1187-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1188-
.unwrap();
1188+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1189+
.unwrap();
11891190
assert!(proof.verify(&statements[0], &mut transcripts[0]).is_ok());
11901191

11911192
// Serialize the proof
@@ -1207,9 +1208,8 @@ mod test {
12071208
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
12081209

12091210
// Generate and verify a proof
1210-
let proof =
1211-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1212-
.unwrap();
1211+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1212+
.unwrap();
12131213
assert!(proof.verify(&statements[0], &mut transcripts[0]).is_ok());
12141214

12151215
// Serialize the proof
@@ -1232,7 +1232,7 @@ mod test {
12321232

12331233
// Generate the proofs
12341234
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1235-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1235+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
12361236
.collect::<Vec<TriptychProof>>();
12371237

12381238
// Verify the batch with and without blame
@@ -1261,7 +1261,7 @@ mod test {
12611261

12621262
// Generate the proofs
12631263
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1264-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1264+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
12651265
.collect::<Vec<TriptychProof>>();
12661266

12671267
// Manipulate a transcript so the corresponding proof is invalid
@@ -1285,7 +1285,7 @@ mod test {
12851285

12861286
// Generate the proofs
12871287
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1288-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1288+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
12891289
.collect::<Vec<TriptychProof>>();
12901290

12911291
// Iteratively manipulate each transcript to make the corresponding proof invalid
@@ -1319,7 +1319,7 @@ mod test {
13191319

13201320
// Generate the proofs
13211321
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1322-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1322+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
13231323
.collect::<Vec<TriptychProof>>();
13241324

13251325
// Manipulate some of the transcripts to make the corresponding proofs invalid
@@ -1346,8 +1346,8 @@ mod test {
13461346
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
13471347

13481348
// Generate a proof
1349-
let proof = TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0])
1350-
.unwrap();
1349+
let proof =
1350+
TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0]).unwrap();
13511351

13521352
// Generate a modified transcript
13531353
let mut evil_transcript = Transcript::new(b"Evil transcript");
@@ -1366,9 +1366,8 @@ mod test {
13661366
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
13671367

13681368
// Generate a proof
1369-
let proof =
1370-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1371-
.unwrap();
1369+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1370+
.unwrap();
13721371

13731372
// Generate a statement with a modified input set
13741373
let mut M = statements[0].get_input_set().get_keys().to_vec();
@@ -1398,9 +1397,8 @@ mod test {
13981397
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
13991398

14001399
// Generate a proof
1401-
let proof =
1402-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1403-
.unwrap();
1400+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1401+
.unwrap();
14041402

14051403
// Generate a statement with a modified input set
14061404
let M = statements[0].get_input_set().get_keys().to_vec();
@@ -1430,9 +1428,8 @@ mod test {
14301428
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
14311429

14321430
// Generate a proof
1433-
let proof =
1434-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1435-
.unwrap();
1431+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1432+
.unwrap();
14361433

14371434
// Generate a statement with a modified linking tag
14381435
let evil_statement = TriptychStatement::new(
@@ -1457,9 +1454,8 @@ mod test {
14571454
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
14581455

14591456
// Generate a proof
1460-
let proof =
1461-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1462-
.unwrap();
1457+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1458+
.unwrap();
14631459

14641460
// Generate a statement with a modified offset
14651461
let evil_statement = TriptychStatement::new(

‎src/proof.rs

Lines changed: 18 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ impl TriptychProof {
9393
/// You must also supply a [`Transcript`] `transcript`.
9494
///
9595
/// This function specifically avoids constant-time operations for efficiency.
96-
#[cfg(feature = "rand")]
96+
#[cfg(all(feature = "rand", feature = "hazmat"))]
9797
pub fn prove_vartime(
9898
witness: &TriptychWitness,
9999
statement: &TriptychStatement,
@@ -113,6 +113,7 @@ impl TriptychProof {
113113
/// You must also supply a [`CryptoRngCore`] random number generator `rng` and a [`Transcript`] `transcript`.
114114
///
115115
/// This function specifically avoids constant-time operations for efficiency.
116+
#[cfg(feature = "hazmat")]
116117
pub fn prove_with_rng_vartime<R: CryptoRngCore>(
117118
witness: &TriptychWitness,
118119
statement: &TriptychStatement,
@@ -1051,7 +1052,7 @@ mod test {
10511052
}
10521053

10531054
#[test]
1054-
#[cfg(feature = "rand")]
1055+
#[cfg(all(feature = "rand", feature = "hazmat"))]
10551056
#[allow(non_snake_case, non_upper_case_globals)]
10561057
fn test_prove_verify_vartime() {
10571058
// Generate data
@@ -1066,6 +1067,7 @@ mod test {
10661067
}
10671068

10681069
#[test]
1070+
#[cfg(feature = "hazmat")]
10691071
#[allow(non_snake_case, non_upper_case_globals)]
10701072
fn test_prove_verify_vartime_with_rng() {
10711073
// Generate data
@@ -1091,9 +1093,8 @@ mod test {
10911093
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
10921094

10931095
// Generate and verify a proof
1094-
let proof =
1095-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1096-
.unwrap();
1096+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1097+
.unwrap();
10971098
assert!(proof.verify(&statements[0], &mut transcripts[0]).is_ok());
10981099

10991100
// Serialize the proof
@@ -1115,9 +1116,8 @@ mod test {
11151116
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
11161117

11171118
// Generate and verify a proof
1118-
let proof =
1119-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1120-
.unwrap();
1119+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1120+
.unwrap();
11211121
assert!(proof.verify(&statements[0], &mut transcripts[0]).is_ok());
11221122

11231123
// Serialize the proof
@@ -1140,7 +1140,7 @@ mod test {
11401140

11411141
// Generate the proofs
11421142
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1143-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1143+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
11441144
.collect::<Vec<TriptychProof>>();
11451145

11461146
// Verify the batch with and without blame
@@ -1169,7 +1169,7 @@ mod test {
11691169

11701170
// Generate the proofs
11711171
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1172-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1172+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
11731173
.collect::<Vec<TriptychProof>>();
11741174

11751175
// Manipulate a transcript so the corresponding proof is invalid
@@ -1193,7 +1193,7 @@ mod test {
11931193

11941194
// Generate the proofs
11951195
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1196-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1196+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
11971197
.collect::<Vec<TriptychProof>>();
11981198

11991199
// Iteratively manipulate each transcript to make the corresponding proof invalid
@@ -1227,7 +1227,7 @@ mod test {
12271227

12281228
// Generate the proofs
12291229
let proofs = izip!(witnesses.iter(), statements.iter(), transcripts.clone().iter_mut())
1230-
.map(|(w, s, t)| TriptychProof::prove_with_rng_vartime(w, s, &mut rng, t).unwrap())
1230+
.map(|(w, s, t)| TriptychProof::prove_with_rng(w, s, &mut rng, t).unwrap())
12311231
.collect::<Vec<TriptychProof>>();
12321232

12331233
// Manipulate some of the transcripts to make the corresponding proofs invalid
@@ -1254,8 +1254,8 @@ mod test {
12541254
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
12551255

12561256
// Generate a proof
1257-
let proof = TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0])
1258-
.unwrap();
1257+
let proof =
1258+
TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0]).unwrap();
12591259

12601260
// Generate a modified transcript
12611261
let mut evil_transcript = Transcript::new(b"Evil transcript");
@@ -1274,9 +1274,8 @@ mod test {
12741274
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
12751275

12761276
// Generate a proof
1277-
let proof =
1278-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1279-
.unwrap();
1277+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1278+
.unwrap();
12801279

12811280
// Generate a statement with a modified input set
12821281
let mut M = statements[0].get_input_set().get_keys().to_vec();
@@ -1300,9 +1299,8 @@ mod test {
13001299
let (witnesses, statements, mut transcripts) = generate_data(n, m, 1, &mut rng);
13011300

13021301
// Generate a proof
1303-
let proof =
1304-
TriptychProof::prove_with_rng_vartime(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1305-
.unwrap();
1302+
let proof = TriptychProof::prove_with_rng(&witnesses[0], &statements[0], &mut rng, &mut transcripts[0].clone())
1303+
.unwrap();
13061304

13071305
// Generate a statement with a modified linking tag
13081306
let evil_statement = TriptychStatement::new(

‎src/util.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ use zeroize::Zeroize;
1212

1313
/// Options for constant- or variable-time operations.
1414
#[derive(Clone, Copy)]
15+
#[allow(dead_code)]
1516
pub(crate) enum OperationTiming {
1617
/// The operation should attempt to run in constant time
1718
Constant,

0 commit comments

Comments
 (0)