path: root/src/org/gnunet/voting/Authority.java

package org.gnunet.voting;

import com.google.common.collect.Lists;
import com.google.common.collect.Maps;

import java.math.BigInteger;
import java.util.List;
import java.util.Map;

/**
 * ...
 *
 * @author Florian Dold
 */
public class Authority {
    private BigInteger privateKeyShare;
    private BigInteger[] secretPolynomial;
    private TransmitShareVerification shareVerification;

    private int authorityId;

    private BigInteger receivedShare = BigInteger.ZERO;

    private VotingParameters parameters;
    private List<Authority> participatingAuthorities;

    private List<Ballot> ballots = Lists.newLinkedList();

    private Map<Integer, TallyKeyShare> specializedKeyShares = Maps.newTreeMap();

    private Cyphertext encryptedTally;
    private BigInteger tallyBaseG;


    /**
     * The commitments of each authority to it's share of the group secret.
     */
    Map<Integer, BigInteger> shareCommitments = Maps.newTreeMap();

    private GroupPublicKey groupPublicKey;


    public Authority() {
    }

    public BigInteger getPublicKeyShare() {
        return parameters.g.modPow(privateKeyShare, parameters.p);
    }

    public BigInteger createShareForAuthority(int j) {
        return CryptoUtil.evaluatePolynomial(secretPolynomial, BigInteger.valueOf(j), parameters.q);
    }

    public void verifyShare(BigInteger distributionShare, TransmitShareVerification senderVerification) {
        BigInteger v = parameters.g.modPow(distributionShare, parameters.p);
        BigInteger prod = BigInteger.ONE;
        for (int l = 0; l < parameters.authorityThreshold; ++l) {
            BigInteger exp = BigInteger.valueOf(this.getId()).pow(l);
            BigInteger coeff = senderVerification.coeffs[l];
            prod = prod.multiply(coeff.modPow(exp, parameters.p)).mod(parameters.p);
        }
        if (!v.equals(prod)) {
            throw new AssertionError("verification of transmitted shared failed");
        }
    }

    public void acceptShareFromAuthority(BigInteger distributionShare, TransmitShareVerification senderVerification, Authority sender) {
        verifyShare(distributionShare, senderVerification);
        receivedShare = receivedShare.add(distributionShare);
    }

    public int getId() {
        return authorityId;
    }

    /**
     * Supervisor -> Authority
     *
     * @param authorityId
     * @param parameters
     * @return
     */
    public BigInteger inviteAuthority(int authorityId, VotingParameters parameters) {
        this.authorityId = authorityId;
        this.parameters = parameters;

        this.privateKeyShare = parameters.generateZq();
        this.secretPolynomial = new BigInteger[parameters.authorityThreshold];

        this.secretPolynomial[0] = privateKeyShare;
        for (int i = 1; i < parameters.authorityThreshold; ++i) {
            secretPolynomial[i] = parameters.generateZq();
        }

        shareVerification = new TransmitShareVerification(secretPolynomial, parameters);

        return getPublicKeyShare();
    }

    /**
     * Supervisor -> Authority.
     *
     * @param participatingAuthorities
     */
    public void generateKeyWithAuthorities(List<Authority> participatingAuthorities) {
        this.participatingAuthorities = participatingAuthorities;

        for (Authority otherAuthority : participatingAuthorities) {
            otherAuthority.acceptShareFromAuthority(createShareForAuthority(otherAuthority.getId()), shareVerification, this);
        }
    }

    public void acceptBallot(Ballot ballot) {
        verifyBallot(ballot);
        // todo: check duplicates
        ballots.add(ballot);

    }

    public void acceptGroupPublicKey(GroupPublicKey key) {
        groupPublicKey = key;
    }

    public void acceptSpecializedKeyShare(TallyKeyShare share, Authority sender) {
        specializedKeyShares.put(sender.getId(), share);
        verifyTallyKeyShare(share);
    }

    public void distributeTallyKey() {
        computeEncryptedTally();

        for (Authority other : participatingAuthorities) {
            TallyKeyShare tallyKeyShare = new TallyKeyShare(encryptedTally.c1, receivedShare, parameters);
            other.acceptSpecializedKeyShare(tallyKeyShare, this);
        }
    }

    private void computeEncryptedTally() {
        BigInteger votesX = BigInteger.ONE;
        BigInteger votesY = BigInteger.ONE;
        for (Ballot ballot : ballots) {
            votesX = votesX.multiply(ballot.x).mod(parameters.p);
            votesY = votesY.multiply(ballot.y).mod(parameters.p);
        }

        encryptedTally = new Cyphertext(votesX, votesY);
    }

    private void decryptTallyToBaseG() {
        Map<Integer, BigInteger> lagrangeCoefficients = Maps.newTreeMap();
        for (int j : specializedKeyShares.keySet()) {
            BigInteger n = BigInteger.ONE;
            BigInteger d = BigInteger.ONE;
            for (int l : specializedKeyShares.keySet()) {
                if (l != j) {
                    n = n.multiply(BigInteger.valueOf(l));
                    d = d.multiply(BigInteger.valueOf(l).subtract(BigInteger.valueOf(j)));
                }
            }
            lagrangeCoefficients.put(j, n.multiply(d.modInverse(parameters.q)).mod(parameters.q));
        }

        BigInteger prod = BigInteger.ONE;
        for (int authorityIndex : specializedKeyShares.keySet()) {
            BigInteger wp = specializedKeyShares.get(authorityIndex).w.modPow(lagrangeCoefficients.get(authorityIndex), parameters.p);
            prod = prod.multiply(wp).mod(parameters.p);
        }

        tallyBaseG = encryptedTally.c2.multiply(prod.modInverse(parameters.p)).mod(parameters.p);
    }

    public int decryptTally() {
        decryptTallyToBaseG();

        int resultRestored = 0;
        boolean success = false;

        for (int l = -ballots.size(); l <= ballots.size(); ++l) {
            if (tallyBaseG.equals(parameters.g.modPow(BigInteger.valueOf(l), parameters.p))) {
                success = true;
                resultRestored = l;
                break;
            }
        }

        if (!success) {
            throw new AssertionError();
        }
        return resultRestored;
    }

    /*
    * Sigma is the the authority's commitment to its share
    */
    public void verifyTallyKeyShare(TallyKeyShare share) {
        BigInteger p = parameters.p;
        BigInteger g = parameters.g;

        BigInteger c1 = share.c1;
        BigInteger a = share.a;
        BigInteger r = share.r;
        BigInteger b = share.b;
        BigInteger c = share.c;

        // verifier
        BigInteger expected1 = g.modPow(r, p);
        BigInteger received1 = a.multiply(share.sigma.modPow(c, p)).mod(p);

        BigInteger expected2 = c1.modPow(r, p);
        BigInteger received2 = b.multiply(share.w.modPow(c, p)).mod(p);

        if ((!expected1.equals(received1)) || (!expected2.equals(received2))) {
            System.err.println(expected1);
            System.err.println(received1);
            throw new AssertionError("zero knowledge proof for decryption failed");
        }
    }



    public void verifyBallot(Ballot ballot) {
        BigInteger g = parameters.g;
        BigInteger p = parameters.p;
        BigInteger h = groupPublicKey.getKey();
        // verifier

        BigInteger voterId = ballot.voterId;
        BigInteger x = ballot.x;
        BigInteger y = ballot.y;
        BigInteger a_1 = ballot.a_1;
        BigInteger a_2 = ballot.a_2;
        BigInteger b_1 = ballot.b_1;
        BigInteger b_2 = ballot.b_2;
        BigInteger c = ballot.c;
        BigInteger d_1 = ballot.d_1;
        BigInteger d_2 = ballot.d_2;
        BigInteger r_1 = ballot.r_1;
        BigInteger r_2 = ballot.r_2;


        // todo: we should blame someone here, not throw exceptions


        if (!c.equals(CryptoUtil.hash(voterId, x, y, a_1, b_1, a_2, b_2).mod(parameters.q))) {
            throw new AssertionError();
        }

        if (!c.equals(d_1.add(d_2).mod(p))) {
            throw new AssertionError();
        }
        if (!a_1.equals(g.modPow(r_1, p).multiply(x.modPow(d_1, p)).mod(p))) {
            throw new AssertionError();
        }
        if (!b_1.equals(h.modPow(r_1, p).multiply(y.multiply(g).modPow(d_1, p)).mod(p))) {
            throw new AssertionError();
        }

        if (!a_2.equals(g.modPow(r_2, p).multiply(x.modPow(d_2, p)).mod(p))) {
            throw new AssertionError();
        }

        if (!b_2.equals(h.modPow(r_2, p).multiply(y.multiply(g.modInverse(p)).modPow(d_2, p)).mod(p))) {
            throw new AssertionError();
        }
    }
}