mirror of
https://github.com/luxfi/crypto.git
synced 2026-07-27 01:54:50 +00:00
Hanzo AI
7ffcd727df
Pippenger's window method (banderwagon.MultiExp) branches on scalar digits, leaking secret prover-side scalars to a Flush+Reload attacker. Wrap MultiExp with multiplicative blinding (k_i -> k_i*r, post-multiply by r^-1 via Fermat) so the cache trace depends on a fresh per-call r instead of the underlying witness/blinding scalars. Five prover-side call sites switched to the blinded path: - prover.go:109,113,118,122 (a_R/a_L witness halves and z_L/z_R) - config.go:64 IPAConfig.Commit (full witness polynomial; trades the PrecompMSM precomputed-table speedup for protection of secret coeffs) Verifier-side callers (verifier.go:50,70 and multiproof.go:241) keep using the unblinded MultiScalar since they only consume public scalars. r is sampled via crypto/rand and converted to Montgomery form so the downstream Mul/Exp operate consistently with ScalarsMont:true. r^-1 uses Fermat (r^(q-2)) for a constant-iteration inversion ladder rather than the variable-time extended-Euclidean Inverse. A post-MSM normalization restores the canonical (0,1,1) projective form for the identity element, since gnark's scalarMulGLV produces a non-canonical representation that confuses Element.Equal. Tests in ipa/ipa/prover_blinding_test.go: 600 random correctness checks across 6 input sizes (n=2,4,8,64,128,256), input-mutation guard, length-mismatch error, and a timing-variance smoke test (cv ~34%, indicates fresh r per call exercises the masking path).
go-ipa
go-ipa is a library of cryptographic primitives for Verkle Trees.
Table of Contents
Description
go-ipa implements the Verkle Tree cryptography spec with extra optimizations.
The includes:
- Implementation of the Bandersnatch curve, and Banderwagon prime-order group.
- Pedersen Commitment for vector commitments using precomputed tables.
- Inner Product Argument prover and verifier implementations for polynomials in evaluation form.
- Multiproof prover and verifier implementations.
Usage in Verkle Tree client libraries
It's extremely important that clients using this library for Verkle Tree implementations only use the following packages:
commonfor general utility functions.banderwagonfor the prime-order group.ipafor proof generation and verification.
Do not use the bandersnatch package directly nor use unsafe functions to get into banderwagon internals. Doing so can create a security vulnerability in your implementation.
Test & Benchmarks
To run the tests and benchmarks, run the following commands:
$ go test ./...
To run the benchmarks:
go test ./... -bench=. -run=none -benchmem
Security
If you find any security vulnerability, please don't open a GH issue and contact repo owners directly.
LICENSE
MIT and Apache 2.0.