/*
Copyright IBM Corp. All Rights Reserved.

SPDX-License-Identifier: Apache-2.0
*/

syntax = "proto3";

option go_package = "github.com/IBM/idemix/bccsp/schemes/dlog/idemix";

// The Identity Mixer protocols make use of pairings (bilinear maps) -
// functions that can be described as e: G1 x G2 -> GT  that
// map group elements from the source groups (G1 and G2) to the target group
// Such groups can be represented by the points on an elliptic curve

package idemix;

import "bccsp/schemes/dlog/crypto/translator/amcl/amcl.proto";

// IssuerPublicKey specifies an issuer public key that consists of
// attribute_names - a list of the attribute names of a credential issued by the issuer
// h_sk, h_rand, h_attrs, w, bar_g1, bar_g2 - group elements corresponding to the signing key, randomness, and attributes
// proof_c, proof_s compose a zero-knowledge proof of knowledge of the secret key
// hash is a hash of the public key appended to it
message IssuerPublicKey {
	repeated string attribute_names = 1;
	amcl.ECP h_sk = 2;
	amcl.ECP h_rand = 3;
	repeated amcl.ECP h_attrs = 4;
	amcl.ECP2 w = 5;
	amcl.ECP bar_g1 = 6;
	amcl.ECP bar_g2 = 7;
	bytes proof_c = 8;
	bytes proof_s = 9;
	bytes hash = 10;
}

// IssuerKey specifies an issuer key pair that consists of
// ISk - the issuer secret key and
// IssuerPublicKey - the issuer public key
message IssuerKey {
	bytes isk = 1;
	IssuerPublicKey ipk = 2;
}

// Credential specifies a credential object that consists of
// a, b, e, s - signature value
// attrs - attribute values
message Credential {
	amcl.ECP a = 1;
	amcl.ECP b = 2;
	bytes e = 3;
	bytes s = 4;
	repeated bytes attrs = 5;
}

// CredRequest specifies a credential request object that consists of
// nym - a pseudonym, which is a commitment to the user secret
// issuer_nonce - a random nonce provided by the issuer
// proof_c, proof_s - a zero-knowledge proof of knowledge of the
// user secret inside Nym
message CredRequest {
	amcl.ECP nym = 1;
	bytes issuer_nonce = 2;
	bytes proof_c = 3;
	bytes proof_s = 4;
}

// EIDNym specifies a pseudonymous enrollment id object that consists of
// nym - pseudonymous enrollment id
// s_eid - field element
message EIDNym {
	amcl.ECP nym = 1;
	bytes proof_s_eid = 2;
}

// RHNym specifies a pseudonymous revocation handle object that consists of
// nym - pseudonymous revocation handle
// s_rh - field element
message RHNym {
	amcl.ECP nym = 1;
	bytes proof_s_rh = 2;
}

// Signature specifies a signature object that consists of
// a_prime, a_bar, b_prime, proof_* - randomized credential signature values
// and a zero-knowledge proof of knowledge of a credential
// and the corresponding user secret together with the attribute values
// nonce - a fresh nonce used for the signature
// nym - a fresh pseudonym (a commitment to to the user secret)
message Signature {
	amcl.ECP a_prime = 1;
	amcl.ECP a_bar = 2;
	amcl.ECP b_prime = 3;
	bytes proof_c = 4;
	bytes proof_s_sk = 5;
	bytes proof_s_e = 6;
	bytes proof_s_r2 = 7;
	bytes proof_s_r3 = 8;
	bytes proof_s_s_prime = 9;
	repeated bytes proof_s_attrs = 10;
	bytes nonce = 11;
	amcl.ECP nym = 12;
	bytes proof_s_r_nym = 13;
	amcl.ECP2 revocation_epoch_pk = 14;
	bytes revocation_pk_sig = 15;
	int64 epoch = 16;
	NonRevocationProof non_revocation_proof = 17;
	EIDNym eid_nym = 18;
	RHNym rh_nym = 19;
}

// NonRevocationProof contains proof that the credential is not revoked
message NonRevocationProof {
	int32 revocation_alg = 1;
	bytes non_revocation_proof = 2;
}

// NymSignature specifies a signature object that signs a message
// with respect to a pseudonym. It differs from the standard idemix.signature in the fact that
// the  standard signature object also proves that the pseudonym is based on a secret certified by
// a CA (issuer), whereas NymSignature only proves that the the owner of the pseudonym
// signed the message
message NymSignature {
	// proof_c is the Fiat-Shamir challenge of the ZKP
	bytes proof_c = 1;
	// proof_s_sk is the s-value proving knowledge of the user secret key
	bytes proof_s_sk = 2;
	//proof_s_r_nym is the s-value proving knowledge of the pseudonym secret
	bytes proof_s_r_nym = 3;
	// nonce is a fresh nonce used for the signature
	bytes nonce = 4;
}

message CredentialRevocationInformation {
	// epoch contains the epoch (time window) in which this CRI is valid
	int64 epoch = 1;

	// epoch_pk is the public key that is used by the revocation authority in this epoch
	amcl.ECP2 epoch_pk = 2;

	// epoch_pk_sig is a signature on the EpochPK valid under the revocation authority's long term key
	bytes epoch_pk_sig = 3;

	// revocation_alg denotes which revocation algorithm is used
	int32 revocation_alg = 4;

	// revocation_data contains data specific to the revocation algorithm used
	bytes revocation_data = 5;
}
