Struct SsaCommitmentProof 

pub struct SsaCommitmentProof<S: PixSpec> {
    nonce_commitment: PixGroupRepr<S>,
    response: <PixScalar<S> as PrimeField>::Repr,
}

Proof that whoever published an SsaCommitment knows its discrete logarithm.

Why this exists

The SSA deposit key is s + e, where s is the sum of the Entry’s polynomial constant terms and e is the Exit’s commitment secret. The deposit is safe precisely because neither party knows the sum. But the Exit publishes e·G first — the SsaRequest message carries it so the Entry can derive the address it has to fund — and without this proof nothing stops a malicious Entry from picking a w it knows, publishing constant terms that sum to w·G − e·G, and ending up with a deposit address whose key is w. It could then sweep its own deposit while the polynomial whose constant term it does not know never yields a valid share, so the Exit is never paid — and because the Entry chooses the order in which polynomials are drained, it can place that one last and be served nearly the whole cycle first.

Requiring proof of knowledge of s closes this, and the case analysis is exhaustive:

• if the Entry can produce the proof it knows s, and then s + e is out of reach because e is not;
• if it cannot, the Exit rejects the SSA before it ever publishes a deposit address.

The proof is over the sum rather than per polynomial on purpose: an individual constant-term commitment whose discrete log the Entry does not know is harmless, as long as the sum’s is known, because the deposit key is then still unreachable.

The Exit needs no matching proof as long as it keeps committing first — it cannot adapt e·G to the Entry’s commitment, so the symmetric attack is unavailable to it. Reversing the message order would move the exploit to the Exit and oblige it to prove instead.

Construction

A standard non-interactive Schnorr proof of knowledge: R = r·G, c = H(ssa_id ‖ commitment ‖ R), z = r + c·s, verified as z·G == R + c·commitment. Neither component is secret, so both travel and print in the clear.

Fields

nonce_commitment: PixGroupRepr<S>

Commitment to the proof nonce, R = r·G.

response: <PixScalar<S> as PrimeField>::Repr

Response, z = r + c·s.

Implementations

impl<S: PixSpec> SsaCommitmentProof<S>

pub const SIZE: usize

Byte size of the serialized proof: the nonce commitment followed by the response.

pub fn prove( ssa_id: &SsaId<S::Pseudonym>, secret: &PixScalar<S>, ssa_commitment: &PixGroup<S>, ) -> Result<Self, S::Pseudonym>

Proves knowledge of secret, the discrete logarithm of ssa_commitment.

pub fn verify( &self, ssa_id: &SsaId<S::Pseudonym>, ssa_commitment: &PixGroup<S>, ) -> bool

Checks the proof against the ssa_commitment it is supposed to open.

Returns false for anything malformed as well as for a genuine verification failure — a caller cannot act differently on the two, since both mean the commitment is unusable.

pub fn to_bytes(&self) -> Vec<u8>

Serializes the proof as nonce_commitment ‖ response, exactly Self::SIZE bytes.

pub fn try_from_bytes(bytes: &[u8]) -> Result<Self, S::Pseudonym>

Parses a proof from the layout produced by Self::to_bytes.

Only the length is checked here; whether the components are meaningful is decided by Self::verify, so that a malformed proof and an invalid one take the same path.

Trait Implementations

impl<S: PixSpec> Clone for SsaCommitmentProof<S>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: PixSpec> Copy for SsaCommitmentProof<S>

impl<S: Debug + PixSpec> Debug for SsaCommitmentProof<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de, S: PixSpec> Deserialize<'de> for SsaCommitmentProof<S>

where PixGroupRepr<S>: Deserialize<'de>, <PixScalar<S> as PrimeField>::Repr: Deserialize<'de>,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl<S: PixSpec> Eq for SsaCommitmentProof<S>

impl<S: PixSpec> PartialEq for SsaCommitmentProof<S>

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl<S: PixSpec> Serialize for SsaCommitmentProof<S>

where PixGroupRepr<S>: Serialize, <PixScalar<S> as PrimeField>::Repr: Serialize,

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.