Struct Verifier

pub struct Verifier { /* private fields */ }

A batch verification context.

Implementations

impl Verifier

pub fn new() -> Verifier

Construct a new batch verifier.

pub fn queue<I: Into<Item>>(&mut self, item: I)

Queue an Item for verification.

pub fn verify<R: RngCore + CryptoRng>(self, rng: R) -> Result<(), Error>

Perform batch verification, returning Ok(()) if all signatures were valid and Err otherwise.

The batch verification equation is:

h_G * -[sum(z_i * s_i)]P_G + sum([z_i]R_i + [z_i * c_i]VK_i) = 0_G

which we split out into:

h_G * -[sum(z_i * s_i)]P_G + sum([z_i]R_i) + sum([z_i * c_i]VK_i) = 0_G

so that we can use multiscalar multiplication speedups.

where for each signature i,

• VK_i is the verification key;
• R_i is the signature’s R value;
• s_i is the signature’s s value;
• c_i is the hash of the message and other data;
• z_i is a random 128-bit Scalar;
• h_G is the cofactor of the group;
• P_G is the generator of the subgroup;

Since decaf377-rdsa uses a different generator for each signature domain, we have a separate scalar accumulator for each domain, but we can still amortize computation nicely in one multiscalar multiplication:

h_G * ( [-sum(z_i * s_i): i_type == SpendAuth]P_SpendAuth + [-sum(z_i * s_i): i_type == Binding]P_Binding + sum([z_i]R_i) + sum([z_i * c_i]VK_i) ) = 0_G

As follows elliptic curve scalar multiplication convention, scalar variables are lowercase and group point variables are uppercase. This does not exactly match the RedDSA notation in the Zcash protocol specification §B.1.

Trait Implementations

impl Default for Verifier

fn default() -> Verifier

Returns the “default value” for a type.