Implement the homomorphic encryption in circuit

[layerxcom]

Implement the homomorphic encryption in circuit

[osuketh]

Add the lifted-ElGamal.
It will encrypt the 32 bits integer and might need the suited statistical algorithm for the decryption of the transfer value. Anyway, the lifted-ElGamal is not expensive rather than paillier.

[osuketh]

The algorithm of Lifted-Elgamal

• Encryption

Enc(m) = (mP + r(sP), rP)
where m: message, P: the point on the curve, s: secret key, sP: public key, r: random value

• Decryption

(mP + rsP) - s(rP) = mP

m should be 32-bits num.

• Homomorphic property

Enc(m) + Enc(m')
= (mP + rsP, rP) + (m'P + r'sP, r'P)
= ((m+m')P + (r + r')sP, (r + r')P)
= Enc(m + m')

[osuketh]

TODO:

zero-chain/proofs/src/circuit_transfer.rs

Lines 212 to 219 in 47aaa49

	// TODO:
	// The balance encryption validity.
	// It is a bit complicated bacause we can not know the randomness of balance.
	// { (current_balance)G - (value)G } + (rbar - random)pk_d_sender
	// == (remaining_balance)G + (ivk){ (rbar)G - (random)G }
	// rbar is the current_balance randomness
	// Enc_sender(sender_balance).cl - Enc_sender(value).cl
	// == (remaining_balance)G + ivk(Enc_sender(sender_balance).cr - Enc(random))