LIBRA 中的可验证随机数 VRF

//self是私钥,alpha就是VRF的输入源
pub(super) fn hash_to_curve(&self, alpha: &[u8]) -> EdwardsPoint {
    let mut result = [0u8; 32];
    let mut counter = 0;
    let mut wrapped_point: Option<EdwardsPoint> = None;

    while wrapped_point.is_none() {
        result.copy_from_slice(
            &Sha512::new()
                .chain(&[SUITE, ONE])
                .chain(self.as_bytes())
                .chain(&alpha)
                .chain(&[counter])
                .result()[..32], //这里用的是sha512,但是只取了前半部分,因此是256位
        );
        wrapped_point = CompressedEdwardsY::from_slice(&result).decompress();
        counter += 1;
    }

    wrapped_point.unwrap().mul_by_cofactor()
}

pub(super) fn hash_points(points: &[EdwardsPoint]) -> ed25519_Scalar {
let mut result = [0u8; 32];
let mut hash = Sha512::new().chain(&[SUITE, TWO]);
for point in points.iter() {
    hash = hash.chain(point.compress().to_bytes());
}
result[..16].copy_from_slice(&hash.result()[..16]);
ed25519_Scalar::from_bits(result) //这里实际上对基点就是取模
}

pub(super) fn nonce_generation_bytes(nonce: [u8; 32], h_point: EdwardsPoint) -> [u8; 64] {
let mut k_buf = [0u8; 64];
k_buf.copy_from_slice(
    &Sha512::new()
        .chain(nonce)
        .chain(h_point.compress().as_bytes())
        .result()[..],
); //生成思路也很简单,就是Hash一下,就可以得到一个大整数
k_buf
}

/// A longer private key which is slightly optimized for proof generation.
///
/// This is similar in structure to ed25519_dalek::ExpandedSecretKey. It can be produced from
/// a VRFPrivateKey.
pub struct VRFExpandedPrivateKey {
    pub(super) key: ed25519_Scalar,
    pub(super) nonce: [u8; 32],
}
/// Produces a proof for an input (using the expanded private key)
    pub fn prove(&self, pk: &VRFPublicKey, alpha: &[u8]) -> Proof {
        let h_point = pk.hash_to_curve(alpha);
        //k实际上是一个随机数,这里采用RFC6979中的规则是为了让每次生成的proof都完全一样,
        // 比特币以太坊签名中也是这么使用的. 但是如果你非要用一个随机数,别人也没办法,
        // 并且完全行得通
        let k_scalar =
            ed25519_Scalar::from_bytes_mod_order_wide(&nonce_generation_bytes(self.nonce, h_point));
        //nonce由私钥hash后生成,可以认为私钥确定了,nonce就确定了,而h_point和签名中的用法是一样的,
        // 就是待签名信息        因此原文中共识是这样的:k = ECVRF_nonce_generation(SK,
        // h_string)

        //Gamma = x*H
        let gamma = h_point * self.key;
        //        c = ECVRF_hash_points(H, Gamma, k*B, k*H)
        let c_scalar = hash_points(&[
            h_point,
            gamma,
            ED25519_BASEPOINT_POINT * k_scalar,
            h_point * k_scalar,
        ]);
        //s = (k + c*x) mod q
        //proof={gama,c,s}
        Proof {
            gamma, //这也是VRF生成的随机数
            c: c_scalar,
            s: k_scalar + c_scalar * self.key,
        }
    }

/// An ECVRF public key
#[derive(Serialize, Deserialize, Deref, Debug, PartialEq, Eq)]
pub struct VRFPublicKey(ed25519_PublicKey);
 /// Given a [`Proof`] and an input, returns whether or not the proof is valid for the input
    /// and public key
    pub fn verify(&self, proof: &Proof, alpha: &[u8]) -> Result<()> {
        //同样将已知的确定信息alpha映射到H点
        let h_point = self.hash_to_curve(alpha);
        //PK:是公钥
        let pk_point = CompressedEdwardsY::from_slice(self.as_bytes())
            .decompress()
            .unwrap();
        //c' = ECVRF_hash_points(H, Gamma, U, V)
        let cprime = hash_points(&[
            h_point,
            proof.gamma,
            ED25519_BASEPOINT_POINT * proof.s - pk_point * proof.c, //U=s*B - c*Y
            h_point * proof.s - proof.gamma * proof.c,              //V= s*H - c*Gamma
        ]);
        //相等则有效,不等则无效
        if proof.c == cprime {
            Ok(())
        } else {
            bail!("The proof failed to verify for this public key")
        }
    }