Struct sp_consensus_babe::Transcript

pub struct Transcript { /* private fields */ }

A transcript of a public-coin argument.

The prover’s messages are added to the transcript using append_message, and the verifier’s challenges can be computed using challenge_bytes.

Creating and using a Merlin transcript

To create a Merlin transcript, use Transcript::new(). This function takes a domain separation label which should be unique to the application.

To use the transcript with a Merlin-based proof implementation, the prover’s side creates a Merlin transcript with an application-specific domain separation label, and passes a &mut reference to the transcript to the proving function(s).

To verify the resulting proof, the verifier creates their own Merlin transcript using the same domain separation label, then passes a &mut reference to the verifier’s transcript to the verification function.

Implementing proofs using Merlin

For information on the design of Merlin and how to use it to implement a proof system, see the documentation at merlin.cool, particularly the Using Merlin section.

Implementations

impl Transcript

pub fn new(label: &'static [u8]) -> Transcript

Initialize a new transcript with the supplied label, which is used as a domain separator.

Note

This function should be called by a proof library’s API consumer (i.e., the application using the proof library), and not by the proof implementation. See the Passing Transcripts section of the Merlin website for more details on why.

pub fn append_message(&mut self, label: &'static [u8], message: &[u8])

Append a prover’s message to the transcript.

The label parameter is metadata about the message, and is also appended to the transcript. See the Transcript Protocols section of the Merlin website for details on labels.

pub fn commit_bytes(&mut self, label: &'static [u8], message: &[u8])

👎Deprecated since 1.1.0: renamed to append_message for clarity.

Deprecated. This function was renamed to append_message.

This is intended to avoid any possible confusion between the transcript-level messages and protocol-level commitments.

pub fn append_u64(&mut self, label: &'static [u8], x: u64)

Convenience method for appending a u64 to the transcript.

The label parameter is metadata about the message, and is also appended to the transcript. See the Transcript Protocols section of the Merlin website for details on labels.

Implementation

Calls append_message with the 8-byte little-endian encoding of x.

pub fn commit_u64(&mut self, label: &'static [u8], x: u64)

👎Deprecated since 1.1.0: renamed to append_u64 for clarity.

Deprecated. This function was renamed to append_u64.

This is intended to avoid any possible confusion between the transcript-level messages and protocol-level commitments.

pub fn challenge_bytes(&mut self, label: &'static [u8], dest: &mut [u8])

Fill the supplied buffer with the verifier’s challenge bytes.

The label parameter is metadata about the challenge, and is also appended to the transcript. See the Transcript Protocols section of the Merlin website for details on labels.

pub fn build_rng(&self) -> TranscriptRngBuilder

Fork the current Transcript to construct an RNG whose output is bound to the current transcript state as well as prover’s secrets.

See the TranscriptRngBuilder documentation for more details.

Trait Implementations

impl Clone for Transcript

fn clone(&self) -> Transcript

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl SigningTranscript for Transcript

We delegate SigningTranscript methods to the corresponding inherent methods of merlin::Transcript and implement two witness methods to avoid abrtasting the merlin::TranscriptRng machenry.

fn commit_bytes(&mut self, label: &'static [u8], bytes: &[u8])

Extend transcript with some bytes, shadowed by merlin::Transcript.

fn challenge_bytes(&mut self, label: &'static [u8], dest: &mut [u8])

Produce some challenge bytes, shadowed by merlin::Transcript.

fn witness_bytes_rng<R>(
    &self,
    label: &'static [u8],
    dest: &mut [u8],
    nonce_seeds: &[&[u8]],
    rng: R
)where
    R: RngCore + CryptoRng,

Produce secret witness bytes from the protocol transcript and any “nonce seeds” kept with the secret keys.

fn proto_name(&mut self, label: &'static [u8])

Extend transcript with a protocol name

fn commit_point(&mut self, label: &'static [u8], compressed: &CompressedRistretto)

Extend the transcript with a compressed Ristretto point

fn challenge_scalar(&mut self, label: &'static [u8]) -> Scalar

Produce the public challenge scalar e.

fn witness_scalar(&self, label: &'static [u8], nonce_seeds: &[&[u8]]) -> Scalar

Produce a secret witness scalar k, aka nonce, from the protocol transcript and any “nonce seeds” kept with the secret keys.

fn witness_bytes(
    &self,
    label: &'static [u8],
    dest: &mut [u8],
    nonce_seeds: &[&[u8]]
)

Produce secret witness bytes from the protocol transcript and any “nonce seeds” kept with the secret keys.

impl Zeroize for Transcript

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.