weijiekoh/elgamal-babyjub

ElGamal Decryption and Re-randomization in Typescript and circom

Warning: do not use this in production as it has not been audited.

This Typescript library implements ElGamal encryption, decryption, and re-randomization on the BabyJub curve. It also provides circom circuits for decryption and re-randomization.

This was written for future implementation of MACI anonymization.

Getting started

Clone this repository, install dependencies, and build the source code:

git clone [email protected]:weijiekoh/elgamal-babyjub.git &&
cd elgamal-babyjub &&
npm i &&
npm run build

Run tests:

npm run test

Library functions

encodeToMessage

encodeToMessage = (original: BigInt): Message

This function converts an arbitrary value within the BabyJub finite field into a BabyJub curve point and an xIncrement value. It generates a random curve point within the BabyJub subgroup and computes the difference between its x-value and the plaintext.

encrypt

encrypt = (plaintext: BigInt, pubKey: PubKey, randomVal?: BigInt): ElGamalCiphertext

This function encrypts a single BigInt plaintext into a ciphertext. Only the owner of the private key associated with pubKey can decrypt it.

decrypt

decrypt = (privKey: PrivKey, ciphertext: ElGamalCiphertext): BigInt

Decrypts a cipertext into the original BigInt.

rerandomize

rerandomize = (pubKey: PubKey, ciphertext: ElGamalCiphertext, randomVal: BigInt = genRandomSalt()): ElGamalCiphertext

Re-randomizes a ciphertext such that its value changes but can be decrypted to the same plaintext.

The randomVal should be specified if one wishes to use the ElGamalReRandomize circuit described below.

Zero-knowledge circuits

ElGamalDecrypt

Input signals:

• c1[2]: The x and y-coordinates of the c1 value of the ciphertext
• c2[2]: The x and y-coordinates of the c2 value of the ciphertext
• xIncrement: The x-increment value of the ciphertext
• privKey (private): The private key

Output signals:

• out: The original value

ElGamalReRandomize

Input signals:

• c1[2]: The x and y-coordinates of the c1 value of the ciphertext
• c2[2]: The x and y-coordinates of the c2 value of the ciphertext
• randomVal: A random value. It must be the same as the one passed to the above rerandomize() function for both the circuit and Typescript function to output the same rerandomized ciphertext.
• pubKey: The public key originally used to encrypt the ciphertext

Output signals:

• d1[2]: The x and y-coordinates of the d1 value of the rerandomized ciphertext
• d2[2]: The x and y-coordinates of the d2 value of the rerandomized ciphertext

elgamal-babyjub's Issues

How does rerandomization work exactly with respect to xIncrement?

Hi, thanks for this implementation.
I am trying to understand something which is not clear for me yet. How does rerandomization preserve anonymity if the xIncrement component of the encrypted Message does not change during this process? Is xIncrement supposed to stay a private variable stored off-chain and decryption proven correct through a zk proof onchain?