zksdk: add type safety to domain seperation

Author: Rexicon226

src/zksdk/merlin.zig

@@ -3,6 +3,7 @@
 //! https://merlin.cool/use/protocol.html
 
 const std = @import("std");
+const builtin = @import("builtin");
 const sig = @import("../sig.zig");
 const Keccak1600 = std.crypto.core.keccak.KeccakF(1600);
 const Ed25519 = std.crypto.ecc.Edwards25519;
@@ -186,17 +187,47 @@ pub const Strobe128 = struct {
 pub const Transcript = struct {
     strobe: Strobe128,
 
-    pub fn init(comptime label: []const u8) Transcript {
-        var transcript: Transcript = .{
-            .strobe = Strobe128.init("Merlin v1.0"),
-        };
-        transcript.appendMessage("dom-sep", label);
+    const DomainSeperator = enum {
+        @"zero-ciphertext-instruction",
+        @"zero-ciphertext-proof",
+        @"pubkey-validity-instruction",
+        @"pubkey-proof",
+        @"percentage-with-cap-proof",
+        @"percentage-with-cap-instruction",
+        @"ciphertext-commitment-equality-proof",
+        @"ciphertext-commitment-equality-instruction",
+        @"ciphertext-ciphertext-equality-proof",
+        @"ciphertext-ciphertext-equality-instruction",
+
+        @"inner-product",
+        @"range-proof",
+        @"batched-range-proof-instruction",
+
+        @"validity-proof",
+        @"batched-validity-proof",
+
+        @"grouped-ciphertext-validity-2-handles-instruction",
+        @"batched-grouped-ciphertext-validity-2-handles-instruction",
+
+        @"grouped-ciphertext-validity-3-handles-instruction",
+        @"batched-grouped-ciphertext-validity-3-handles-instruction",
+    };
+
+    pub fn init(comptime seperator: DomainSeperator) Transcript {
+        var transcript: Transcript = .{ .strobe = Strobe128.init("Merlin v1.0") };
+        transcript.appendDomSep(seperator);
+        return transcript;
+    }
 
+    pub fn initTest(label: []const u8) Transcript {
+        comptime if (!builtin.is_test) @compileError("should only be used during tests");
+        var transcript: Transcript = .{ .strobe = Strobe128.init("Merlin v1.0") };
+        transcript.appendMessage("dom-sep", label);
         return transcript;
     }
 
     /// NOTE: be very careful with this function, there are only a specific few
-    /// usages of it. generally speaking, use the a helper function if it exists.
+    /// usages of it. always use helper functions if possible.
     pub fn appendMessage(
         self: *Transcript,
         comptime label: []const u8,
@@ -209,8 +240,8 @@ pub const Transcript = struct {
         self.strobe.ad(message, false);
     }
 
-    pub fn appendDomSep(self: *Transcript, comptime label: []const u8) void {
-        self.appendMessage("dom-sep", label);
+    pub fn appendDomSep(self: *Transcript, comptime seperator: DomainSeperator) void {
+        self.appendMessage("dom-sep", @tagName(seperator));
     }
 
     pub fn challengeBytes(
@@ -289,10 +320,37 @@ pub const Transcript = struct {
         std.mem.writeInt(u64, &buffer, x, .little);
         self.appendMessage(label, &buffer);
     }
+
+    pub fn appendHandleDomSep(
+        self: *Transcript,
+        comptime mode: enum { batched, unbatched },
+        comptime handles: enum { two, three },
+    ) void {
+        self.appendDomSep(switch (mode) {
+            .batched => .@"batched-validity-proof",
+            .unbatched => .@"validity-proof",
+        });
+        self.appendU64("handles", switch (handles) {
+            .two => 2,
+            .three => 3,
+        });
+    }
+
+    pub fn appendRangeProof(
+        self: *Transcript,
+        comptime mode: enum { range, inner },
+        n: comptime_int,
+    ) void {
+        self.appendDomSep(switch (mode) {
+            .range => .@"range-proof",
+            .inner => .@"inner-product",
+        });
+        self.appendU64("n", n);
+    }
 };
 
 test "equivalence" {
-    var transcript = Transcript.init("test protocol");
+    var transcript = Transcript.initTest("test protocol");
 
     transcript.appendMessage("some label", "some data");
 

src/zksdk/range_proof/bulletproofs.zig

@@ -123,8 +123,7 @@ pub fn Proof(bit_size: comptime_int) type {
             }
             std.debug.assert(nm == bit_size);
 
-            transcript.appendDomSep("range-proof");
-            transcript.appendU64("n", bit_size);
+            transcript.appendRangeProof(.range, bit_size);
 
             // bit-decompose values and generate their Pedersen vector commitment
             const a_blinding: Scalar = .random();
@@ -269,8 +268,7 @@ pub fn Proof(bit_size: comptime_int) type {
         ) !void {
             std.debug.assert(commitments.len == bit_lengths.len);
 
-            transcript.appendDomSep("range-proof");
-            transcript.appendU64("n", bit_size);
+            transcript.appendRangeProof(.range, bit_size);
 
             try transcript.validateAndAppendPoint("A", self.A);
             try transcript.validateAndAppendPoint("S", self.S);
@@ -659,7 +657,7 @@ pub fn Data(bit_size: comptime_int) type {
             }
 
             fn newTranscript(self: Context) Transcript {
-                var transcript = Transcript.init("batched-range-proof-instruction");
+                var transcript = Transcript.init(.@"batched-range-proof-instruction");
                 transcript.appendMessage(
                     "commitments",
                     std.mem.sliceAsBytes(&self.commitments),
@@ -699,8 +697,8 @@ pub fn genPowers(comptime n: usize, x: Scalar) [n]Scalar {
 test "single rangeproof" {
     const commitment, const opening = pedersen.initValue(u64, 55);
 
-    var creation_transcript = Transcript.init("Test");
-    var verification_transcript = Transcript.init("Test");
+    var creation_transcript = Transcript.initTest("Test");
+    var verification_transcript = Transcript.initTest("Test");
 
     const proof = try Proof(32).init(
         &.{55},
@@ -721,8 +719,8 @@ test "aggregated rangeproof" {
     const comm2, const opening2 = pedersen.initValue(u64, 77);
     const comm3, const opening3 = pedersen.initValue(u64, 99);
 
-    var creation_transcript = Transcript.init("Test");
-    var verification_transcript = Transcript.init("Test");
+    var creation_transcript = Transcript.initTest("Test");
+    var verification_transcript = Transcript.initTest("Test");
 
     const proof = try Proof(128).init(
         &.{ 55, 77, 99 },
@@ -753,7 +751,7 @@ test "proof string" {
     const proof = try Proof(128).fromBase64(proof_string);
     // zig fmt: on
 
-    var verification_transcript = Transcript.init("Test");
+    var verification_transcript = Transcript.initTest("Test");
     try proof.verify(
         &.{ commitment_1, commitment_2, commitment_3 },
         &.{ 64, 32, 32 },

src/zksdk/range_proof/ipp.zig

@@ -70,8 +70,7 @@ pub fn Proof(bit_size: comptime_int) type {
             var a: []Scalar = a_vec;
             var b: []Scalar = b_vec;
 
-            transcript.appendDomSep("inner-product");
-            transcript.appendU64("n", bit_size);
+            transcript.appendRangeProof(.inner, bit_size);
 
             var L_vec: std.BoundedArray(Ristretto255, logn) = .{};
             var R_vec: std.BoundedArray(Ristretto255, logn) = .{};
@@ -264,8 +263,7 @@ pub fn Proof(bit_size: comptime_int) type {
             [logn]Scalar, // u_inv_sq
             [bit_size]Scalar, // s
         } {
-            transcript.appendDomSep("inner-product");
-            transcript.appendU64("n", bit_size);
+            transcript.appendRangeProof(.inner, bit_size);
 
             // 1. Recompute x_k,...,x_1 based on the proof transcript
             var challenges: [logn]Scalar = undefined;
@@ -397,8 +395,8 @@ test "basic correctness" {
         scalars.buffer,
     ) };
 
-    var prover_transcript = Transcript.init("innerproducttest");
-    var verifier_transcript = Transcript.init("innerproducttest");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof(32).init(
         Q,

src/zksdk/sigma_proofs/ciphertext_ciphertext.zig

@@ -33,7 +33,7 @@ pub const Proof = struct {
         amount: u64,
         transcript: *Transcript,
     ) Proof {
-        transcript.appendDomSep("ciphertext-ciphertext-equality-proof");
+        transcript.appendDomSep(.@"ciphertext-ciphertext-equality-proof");
 
         const P_first = first_kp.public.point;
         const D_first = first_ciphertext.handle.point;
@@ -97,7 +97,7 @@ pub const Proof = struct {
         second_ciphertext: *const ElGamalCiphertext,
         transcript: *Transcript,
     ) !void {
-        transcript.appendDomSep("ciphertext-ciphertext-equality-proof");
+        transcript.appendDomSep(.@"ciphertext-ciphertext-equality-proof");
 
         const P_first = first_pubkey.point;
         const C_first = first_ciphertext.commitment.point;
@@ -256,7 +256,7 @@ pub const Data = struct {
         }
 
         fn newTranscript(self: Context) Transcript {
-            var transcript = Transcript.init("ciphertext-ciphertext-equality-instruction");
+            var transcript = Transcript.init(.@"ciphertext-ciphertext-equality-instruction");
             transcript.appendPubkey("first-pubkey", self.first_pubkey);
             transcript.appendPubkey("second-pubkey", self.second_pubkey);
             transcript.appendCiphertext("first-ciphertext", self.first_ciphertext);
@@ -403,8 +403,8 @@ test "correctness" {
         &second_opening,
     );
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &first_kp,
@@ -439,8 +439,8 @@ test "different messages" {
         &second_opening,
     );
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &first_kp,
@@ -480,7 +480,7 @@ test "proof string" {
     const proof = try Proof.fromBase64(proof_string);
     // zig fmt: on
 
-    var verifier_transcript = Transcript.init("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     try proof.verify(
         &first_pubkey,

src/zksdk/sigma_proofs/ciphertext_commitment.zig

@@ -31,7 +31,7 @@ pub const Proof = struct {
         amount: u64,
         transcript: *Transcript,
     ) Proof {
-        transcript.appendDomSep("ciphertext-commitment-equality-proof");
+        transcript.appendDomSep(.@"ciphertext-commitment-equality-proof");
 
         const P = kp.public;
         const D = ciphertext.handle.point;
@@ -90,7 +90,7 @@ pub const Proof = struct {
         commitment: *const pedersen.Commitment,
         transcript: *Transcript,
     ) !void {
-        transcript.appendDomSep("ciphertext-commitment-equality-proof");
+        transcript.appendDomSep(.@"ciphertext-commitment-equality-proof");
 
         const P = pubkey.point;
         const C_ciphertext = ciphertext.commitment.point;
@@ -217,7 +217,7 @@ pub const Data = struct {
         }
 
         fn newTranscript(self: Context) Transcript {
-            var transcript = Transcript.init("ciphertext-commitment-equality-instruction");
+            var transcript = Transcript.init(.@"ciphertext-commitment-equality-instruction");
             transcript.appendPubkey("pubkey", self.pubkey);
             transcript.appendCiphertext("ciphertext", self.ciphertext);
             transcript.appendCommitment("commitment", self.commitment);
@@ -295,8 +295,8 @@ test "success case" {
     const ciphertext = el_gamal.encrypt(u64, message, &kp.public);
     const commitment, const opening = pedersen.initValue(u64, message);
 
-    var prover_transcript = Transcript.init("Test");
-    var verifier_transcript = Transcript.init("Test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -321,8 +321,8 @@ test "fail case" {
     const ciphertext = el_gamal.encrypt(u64, encrypted_message, &kp.public);
     const commitment, const opening = pedersen.initValue(u64, committed_message);
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -353,8 +353,8 @@ test "public key zeroed" {
     const ciphertext = el_gamal.encrypt(u64, message, &kp.public);
     const commitment, const opening = pedersen.initValue(u64, message);
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -385,8 +385,8 @@ test "all zoered" {
     const commitment = try pedersen.Commitment.fromBytes(.{0} ** 32);
     const opening = try pedersen.Opening.fromBytes(.{0} ** 32);
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -414,8 +414,8 @@ test "commitment zeroed" {
     const commitment = try pedersen.Commitment.fromBytes(.{0} ** 32);
     const opening = try pedersen.Opening.fromBytes(.{0} ** 32);
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -442,8 +442,8 @@ test "ciphertext zeroed" {
     const ciphertext = try ElGamalCiphertext.fromBytes(.{0} ** 64);
     const commitment, const opening = pedersen.initValue(u64, message);
 
-    var prover_transcript = Transcript.init("test");
-    var verifier_transcript = Transcript.init("test");
+    var prover_transcript = Transcript.initTest("Test");
+    var verifier_transcript = Transcript.initTest("Test");
 
     const proof = Proof.init(
         &kp,
@@ -476,7 +476,7 @@ test "proof strings" {
     const proof = try Proof.fromBase64(proof_string);
     // zig fmt: on
 
-    var verifier_transcript = Transcript.init("Test");
+    var verifier_transcript = Transcript.initTest("Test");
     try proof.verify(
         &pubkey,
         &ciphertext,