bn

This is a pairing cryptography library written in pure Rust. It makes use of the Barreto-Naehrig (BN) curve construction from [BCGTV13] to provide two cyclic groups G₁ and G₂, with an efficient bilinear pairing:

e: G₁ × G₂ → G_T

This code is still in early development and should not be used in production software.

Usage

Add the bn crate to your dependencies in Cargo.toml...

toml [dependencies] bn = "0.1.*"

...and add an extern crate declaration to your crate root:

rust extern crate bn;

API

• Scalar is an element of F_r
• G1 is a point on the BN curve E/Fq : y^2 = x^3 + b
• G2 is a point on the twisted BN curve E'/Fq2 : y^2 = x^3 + b/xi
• Gt is a group element (written multiplicatively) obtained with the pairing function over G1 and G2.

Examples

Joux's key agreement protocol

In a typical Diffie-Hellman key exchange, relying on ECDLP, a three-party key exchange requires two rounds. A single round protocol is possible through the use of a bilinear pairing: given Alice's public key aP₁ and Bob's public key bP₂, Carol can compute the shared secret with her private key c by e(aP₁, bP₂)^c.

(See examples/joux.rs for the full example.)

```rust // Generate private keys let alicesk = Scalar::random(rng); let bobsk = Scalar::random(rng); let carol_sk = Scalar::random(rng);

// Generate public keys in G1 and G2 let (alicepk1, alicepk2) = (G1::one() * &alicesk, G2::one() * &alicesk); let (bobpk1, bobpk2) = (G1::one() * &bobsk, G2::one() * &bobsk); let (carolpk1, carolpk2) = (G1::one() * &carolsk, G2::one() * &carolsk);

// Each party computes the shared secret let alicess = pairing(&bobpk1, &carolpk2) ^ &alicesk; let bobss = pairing(&carolpk1, &alicepk2) ^ &bobsk; let carolss = pairing(&alicepk1, &bobpk2) ^ &carolsk;

assert!(alicess == bobss && bobss == carolss); ```

License

Licensed under either of

• MIT license, (LICENSE-MIT or http://opensource.org/licenses/MIT)
• Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)

at your option.

Copyright 2016 Zcash Electric Coin Company. The Zcash Company promises to maintain the "bn" crate on crates.io under this MIT/Apache-2.0 dual license.

Authors

• Sean Bowe

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.