Skip to content

CHANGELOG.md

Latest commit

 

History

History
241 lines (181 loc) · 9.68 KB

CHANGELOG.md

File metadata and controls

241 lines (181 loc) · 9.68 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.5.2] - Unreleased

Added

  • RingContext::new_without_blinding(ring_size): runtime replacement for the removed test-vectors feature. Provers built from such a context generate deterministic (non zero-knowledge) proofs, still valid for verifiers using a regular context for the same ring size.

Changed

  • arkworks dependencies bumped to 0.6.
  • Bump w3f-ring-proof dependency to 0.0.9.

Removed

  • test-vectors feature. Cargo features are additive: any crate in the dependency graph could enable it, silently disabling ring proof blinding for every other user of the same build.

Security

  • The group identity is now rejected as a public key: its secret scalar is zero and publicly known, so anyone can forge proofs verifying against it. Public::from_affine, checked deserialization, and the thin and tiny verifiers (including batch verification) return Error::InvalidData for identity keys.

  • The group identity is now rejected as a VRF input or output point. The pair (0, 0) satisfies O = x * I for every secret key, so it binds its VRF output to no signer. Input::from_affine, Output::from_affine, checked deserialization of both, and all four verifiers (including batch verification) return Error::InvalidData for such a pair.

  • The group identity is now rejected as a Pedersen key commitment. Its opening is the public (0, 0), so anyone can build a proof that satisfies the commitment equation without a secret.

    The identity remains accepted for the nonce commitments R and Ok, which commit to nothing and are not part of the extraction argument. Ok is necessarily the identity when no I/O pair is supplied. This matches the Bandersnatch VRF specification, section 3.2, 3.3, 4.2 and 4.4 step 1.

[0.5.1] - 2026-06-12

Added

  • PcsVerifierParams type alias for the PCS parameters required by the verifier: a few points, independent of ring size, extractable via RingSetup::pcs_verifier_params() or VerifierKeyBuilder::pcs_verifier_params().
  • ring::verifier_key_from_commitment(commitment, pcs_params) free function to reconstruct a RingVerifierKey from a ring commitment without access to the full SRS.

0.5.0 - 2026-04-27

Added

  • RingContext struct for lightweight ring proof parameter caching. Contains only the PIOP parameters needed for prover/verifier instance construction, without the KZG SRS required for key construction.
  • Multi-ring batch verification: a single ring::BatchVerifier can now aggregate proofs from multiple rings sharing the same KZG SRS into one batched pairing check.
  • ring::BatchItem::new(verifier, ios, ad, proof) and pedersen::BatchItem::new(ios, ad, proof) constructors for preparing batch items independently of any verifier instance.

Changed

  • Bump w3f-ring-proof dependency to 0.0.8.
  • RingProofParams renamed to RingSetup.
  • Suite::SUITE_ID is now a self-describing byte string (e.g. b"Bandersnatch-SHA512-ELL2-v1") used directly as the transcript seed and hash-to-curve DST prefix, replacing the structured 4-byte SuiteId { version, curve, hash, h2c }. Transcript::new now takes &[u8]. Breaking change for custom Suite implementations.
  • Hash-to-curve DST unified to SUITE_ID || DomSep::HashToCurve for both Try-And-Increment and Elligator2 paths, replacing the prior "ECVRF_" || h2c_suite_id || suite_bytes form. hash_to_curve_ell2_xmd and hash_to_curve_ell2_xof no longer take a separate h2c_suite_id argument. DomSep::HashToCurveTai is renamed to HashToCurve and shared across both paths; ThinBatch/PedersenBatch collapse into a single BatchVerify.
  • DigestXof counter widened from u32 to u64.
  • Per-suite BLINDING_BASE, ACCUMULATOR_BASE, PADDING points and all test vectors regenerated under the new DSTs; previous values do not verify.

Removed

  • RingProofParams::verifier_no_context method, superseded by RingContext::new.
  • ring::BatchVerifier::prepare and pedersen::BatchVerifier::prepare, superseded by BatchItem::new constructors.
  • SuiteId struct and the curve/hash/h2c constant modules under suites, superseded by the byte-string SUITE_ID.

0.4.0 - 2026-04-02

This release follows draft-33 of the Bandersnatch VRF specification.

Changed

  • Renamed IETF VRF to Tiny VRF. The scheme now uses a single nonce commitment R = k * I_m on the delinearized merged input rather than separate commitments for the generator and each VRF input.
  • Thin VRF is now described as a variant of Tiny VRF that stores the nonce commitment R instead of the challenge c, enabling batch verification at the cost of a slightly larger proof.
  • Updated all test vectors to reflect the new Tiny VRF proof structure.

Removed

  • Blake3Transcript and the blake3 feature/dependency.
  • bandersnatch_blake3 suite (including its test vectors).

0.3.0 - 2026-03-28

This release follows draft-32 of the Bandersnatch VRF specification.

Added

  • Pluggable Transcript trait for Fiat-Shamir transform, replacing the previous hard-coded hash constructions. Provided implementations: HashTranscript (SHA-512, SHA-256 via counter-mode XOF), Blake3Transcript, Shake128Transcript.
  • Suite::Transcript associated type. Nonce generation, challenge derivation, and other hash-based operations now go through the transcript abstraction.
  • Thin VRF scheme. Merges the Schnorr public-key and VRF I/O DLEQ into a single delinearized relation with a Schnorr-like proof (R, s). Supports batch verification via randomized multi-scalar multiplication.
  • Multi-input IETF VRF using delinearized DLEQ. Proves multiple input-output pairs with a single proof via delinearize folding. N=1 is byte-identical to single-pair proving. N=0 reduces to a Schnorr signature over additional data.
  • Straus multi-scalar multiplication (utils::straus::short_msm) for small point counts (n=2..5), with configurable window size. Used in IETF, Pedersen, and Thin VRF verification to replace independent scalar multiplications.

Fixed

  • Challenge serialization now validates that the value fits in CHALLENGE_LEN, rejecting proofs with oversized challenge values.

Changed

  • Suite trait now requires a Transcript associated type and nonce/challenge methods use the transcript rather than raw hash functions. This is a breaking change for custom Suite implementations.
  • Removed CHALLENGE_LEN from the Suite trait; it is now a module-level constant (utils::common::CHALLENGE_LEN) fixed at 16 bytes (128-bit security).
  • Challenge and blinding factor decoding now use suite codec (scalar_decode) instead of from_be_bytes_mod_order, so endianness follows the suite configuration.

0.2.2 - 2026-03-17

Changed

  • Nonce derivation now binds additional data (ad), preventing secret key recovery from two proofs over the same input with different ad. In the IETF scheme ad is included directly; in the Pedersen scheme the two secrets are cross-bound: k nonce includes blinding || ad, kb nonce includes secret || ad.

0.2.1 - 2026-02-19

Changed

  • Bump w3f-ring-proof dependency to 0.0.6.

Removed

  • RingProofParams::clone_verifier_key workaround, no longer needed as upstream RingVerifierKey now implements Clone.

0.2.0 - 2026-02-18

Added

  • Ring proof batch verification using random linear combination.
  • Pedersen proof batch verification with 5N+2 point MSM.
  • Domain size conversion utilities for ring proof parameters.
  • Constant encoded lengths in codec for all proof and signature types.
  • Comprehensive benchmarks for all VRF schemes (IETF, Pedersen, Ring).

Changed

  • Input::from(Affine) renamed to Input::from_affine(Affine).
  • Secret scalar field is now private.

Fixed

  • RFC-6979 nonce generation.

0.1.1 - 2025-12-12

Added

  • secret-split feature: scalar multiplication with secret split for side-channel defense. Secret scalar is split into the sum of two randomly mutating scalars.
  • Ring verifier key builder for incremental ring construction.
  • Optional cofactor clearing for RFC-9381 hash_to_curve.
  • Unlocked sha2 assembly feature.

Changed

  • Bump Rust edition to 2024.
  • Improved secret scalar generation.
  • Simplified ring proof trait bounds using associated type bounds.

0.1.0 - 2025-03-28

Added

  • IETF VRF compliant with RFC-9381 (ECVRF).
  • Pedersen VRF with key-hiding properties.
  • Ring VRF with signer anonymity using zk-SNARK membership proofs.
  • Built-in suites: Ed25519, Secp256r1, Bandersnatch, JubJub, Baby-JubJub.
  • Elligator 2 and Try-and-Increment hash-to-curve strategies.
  • RFC-6979 deterministic nonce generation (optional).
  • Codec trait for customizable serialization formats.
  • Test vectors for all suites and schemes.
  • no_std support.
  • parallel and asm optimization features.