sigma

type Anchor[I algebra.GroupElement[I], P algebra.GroupElement[P]] interface {
	L() *num.Nat
	// PreImage returns w such that phi(w) == x * L()
	PreImage(x I) (w P)
}

type ChallengeBytes []byte

type Commitment base.BytesLike

type MaurerCommitment[I algebra.GroupElement[I]] interface {
	Commitment
	base.Transparent[I]
}

type MaurerProtocol[
	I algebra.GroupElement[I],
	P algebra.GroupElement[P],
	X MaurerStatement[I],
	W MaurerWitness[P],
	A MaurerStatement[I],
	S MaurerState[P],
	Z MaurerResponse[P],
] interface {
	Protocol[X, W, A, S, Z]

	PreImageGroup() algebra.FiniteGroup[P]
	ImageGroup() algebra.FiniteGroup[I]
	Phi() OneWayHomomorphism[I, P]
	Anchor() Anchor[I, P]
}

type MaurerResponse[P algebra.GroupElement[P]] interface {
	Response
	base.Transparent[P]
}

type MaurerState[P algebra.GroupElement[P]] interface {
	State
	base.Transparent[P]
}

type MaurerStatement[I algebra.GroupElement[I]] interface {
	Statement
	base.Transparent[I]
}

type MaurerWitness[P algebra.GroupElement[P]] interface {
	Witness
	base.Transparent[P]
}

type Name string

type OneWayHomomorphism[I algebra.GroupElement[I], P algebra.GroupElement[P]] algebra.Homomorphism[I, P]

type Protocol[X Statement, W Witness, A Commitment, S State, Z Response] interface {
	Name() Name
	ComputeProverCommitment(statement X, witness W) (A, S, error)
	ComputeProverResponse(statement X, witness W, commitment A, state S, challenge ChallengeBytes) (Z, error)
	Verify(statement X, commitment A, challenge ChallengeBytes, response Z) error

	// RunSimulator produces a transcript that's statistically identical to (or indistinguishable from)
	// the output of the real Prover.
	// In the context of Honest-Verifier Zero-Knowledge Proofs of Knowledge,
	// the simulator is an algorithm that is able to fake a commitment and a convincing proof
	// without the knowledge of the witness.
	// To fake it, the simulator "rewinds" (aka does things in reverse order):
	// first create a response, and then compute the commitment intelligently so that the full transcript (a, e, z)
	// would be valid if played in the right order.
	RunSimulator(statement X, challenge ChallengeBytes) (A, Z, error)

	// SpecialSoundness returns n for which protocol has n-special soundness.
	// In other words, it returns a minimal number of how many distinct, valid
	// sigma protocol transcripts T_i = (x, e_i, z_i) for i = 1, 2, ..., n
	// are required for the existence of polynomial-time extractor of witness.
	SpecialSoundness() uint

	// SoundnessError returns the statistical soundness error `s` of the protocol,
	// i.e., the probability that a cheating prover can succeed is ≤ 2^(-s).
	// For interactive proofs it must be at least base.StatisticalSecurity,
	// for non-interactive proofs it must be at least base.ComputationalSecurity.
	SoundnessError() uint
	GetChallengeBytesLength() int

	ValidateStatement(statement X, witness W) error
}

type Prover[X Statement, W Witness, A Commitment, S State, Z Response] struct {
	// contains filtered or unexported fields
}

type Response base.BytesLike

type State any

type Statement base.BytesLike

type Verifier[X Statement, W Witness, A Commitment, S State, Z Response] struct {
	// contains filtered or unexported fields
}

type Witness base.BytesLike