The Alberta Buck - Identity - Cryptography Example (v2)

This table says where each item lives. What the public items can reveal – why a permanently archived registration transaction discloses no identity to any node – is set out item by item in What the Chain Sees, and What It Can Learn.

Alice's wallet reads her Private entries, derives a presentation of her credential entirely offline, then submits it to the IdentityRegistry. The contract verifies the NIZK proof (443,892 gas measured on the A' branch with an in-process EVM) and stores the public artifacts. The secret key, the raw PS signature and the plaintext identity never touch Ethereum; the presentation \( (A, B) \) that does is a uniform pair of points that no holder of the identity – the issuer included – can test.

sequenceDiagram
    participant P as Holochain<br/>(Private entries)
    participant W as Alice's Wallet
    participant IR as IdentityRegistry<br/>(Ethereum)

    W->>P: Read identity_data, m, sigma
    P-->>W: (plaintext, scalar, PS signature)

    rect rgb(240, 248, 255)
    Note over W: Identity Fountain (offline)
    W->>W: Present: A = a*sigma_1, B = a*sigma_2 + b*Y1
    W->>W: Fresh key pair: (sk, pk)
    W->>W: ElGamal encrypt: E = (r*G, m*G + r*pk)
    W->>W: NIZK proof pi over (m, b, r, sk)
    end

    W->>IR: register(issuer, pk, E_alice, (A, B), pi)
    IR->>IR: Verify NIZK (6 checks, 444K gas)
    IR->>IR: Store pk, E_alice
    IR->>IR: isVerified[alice] = true

    W->>P: Store account (sk, pk, E) and discard a, b

When Alice wants to transact with Bob, her wallet first verifies Bob's credentials before re-encrypting. This is the critical trust checkpoint: Alice's wallet reads Bob's on-chain data, checks his PS signature (via the pairing equation) and public key, and only then produces the re-encrypted ciphertext.

If anything is wrong – invalid PS signature, mismatched NIZK proof, revoked credential – Alice simply does not call approve. No transaction, no risk. If Alice's wallet detects provable malfeasance (e.g., a forged PS signature from a revoked issuer), it can issue a Holochain Warrant against Bob's agent. Multiple independent wallets detecting the same fraud produce consensus: the warranted agent becomes untrusted on the DHT.

sequenceDiagram
    participant D as Holochain DHT<br/>(Public)
    participant P as Holochain<br/>(Private)
    participant W as Alice's Wallet
    participant IR as IdentityRegistry<br/>(Ethereum)
    participant B as BUCK ERC-20<br/>(Ethereum)

    W->>P: Read sk_alice
    W->>IR: Read E_alice, pk_bob, isPublicIdentity(bob)
    IR-->>W: E_alice=(R,C), pk_bob, isPublicIdentity=true

    rect rgb(255, 248, 240)
    Note over W: Trust checkpoint
    W->>W: Verify Bob's credentials<br/>(PS pairing, NIZK, revocation status)
    alt Bob's credentials invalid
        W->>D: Issue Warrant(bob_agent)
        W-->>W: ABORT (do not approve)
    end
    end

    W->>W: Decrypt: M = C - sk*R
    W->>W: Re-encrypt for Bob:<br/>E_bob = (r'*G, M + r'*pk_bob)
    W->>W: Chaum-Pedersen proof pi_cp

    W->>B: approve(bob, amount, E_bob, pi_cp)

    Note over B,IR: Contract reads E_alice from<br/>IdentityRegistry (NOT calldata)
    B->>IR: Read E_alice
    IR-->>B: E_alice=(R,C)

    B->>B: Verify Chaum-Pedersen<br/>(4 checks)
    B->>B: _receiptFragments[alice][bob] = H(E_bob)
    B->>B: _allowances[alice][bob] = amount
    B-->>W: ApproveReceipt event

By the time transfer or transferFrom is called, all proofs have already been verified. The EVM code only checks boolean flags and stored receipt fragments – no cryptography runs during the transfer itself. Public-Identity contracts (those bound via bindContract(target, pk, E, isPublicIdentity_=true)) need not have a per-pair receipt fragment: the receipt falls back to the bound _identityHash for that side.

sequenceDiagram
    participant C as Caller
    participant B as BUCK ERC-20<br/>(Ethereum)
    participant IR as IdentityRegistry<br/>(Ethereum)

    C->>B: transfer(bob, 500) or<br/>transferFrom(alice, bob, 500)

    rect rgb(240, 255, 240)
    Note over B,IR: Bilateral identity check
    B->>IR: isVerified(alice) && isVerified(bob)?
    IR-->>B: true, true
    B->>B: _receiptFragments[alice][bob]<br/>exists? YES
    Note over B: aliceFrag = stored ciphertext-hash

    B->>B: _receiptFragments[bob][alice]<br/>exists? NO
    B->>IR: isPublicIdentity(bob)?
    IR-->>B: true
    B->>IR: _identityHash(bob)
    IR-->>B: H(pk_bob, E_bob)
    Note over B: bobFrag = _identityHash(bob)
    end

    B->>B: Standard ERC-20 checks<br/>(balance, allowance)
    B->>B: Execute transfer

    B-->>C: Transfer event + BuckTransferReceipt

After the transfer, Bob verifies Alice's identity using two independent channels. Channel 1 (Ethereum) provides the binding proof; Channel 2 (Holochain) provides the content. Neither channel alone is sufficient – this is what makes the design tamper-evident.

If Bob detects that the off-chain identity_data doesn't match the on-chain point \( M \), this is provable malfeasance: Bob holds the ciphertext (on-chain, timestamped) and the mismatched data (signed by Alice's Holochain agent). Bob issues a Warrant; other agents independently verify the evidence. Since Holochain agents sign their source chain entries, Alice cannot deny having sent the bad data.

sequenceDiagram
    participant D as Holochain DHT<br/>(Public)
    participant BW as Bob's Wallet
    participant ETH as Ethereum

    BW->>ETH: Read E_bob from<br/>ApproveReceipt event
    ETH-->>BW: E_bob = (R', C')
    BW->>BW: Decrypt: M = C' - sk_bob * R'

    Note over BW,D: Channel 2: Holochain data delivery
    D-->>BW: Receive identity_data from Alice<br/>(Remote Signal, encrypted for Bob)

    BW->>BW: Verify: H(identity_data) * G == M?

    alt Match (honest)
        BW->>BW: Identity verified
        BW->>BW: Store receipt (Private entry)
    else Mismatch (malfeasance)
        BW->>D: Issue Warrant(alice_agent)<br/>with evidence: E_bob, identity_data
        Note over D: Other agents verify independently:<br/>decrypt E_bob, check H(data)*G != M
        Note over D: Multiple warrants = consensus<br/>Warranted agent loses DHT trust
    end

The amount of pre-work depends on the visibility of each party:

In every case, the transfer / transferFrom call itself does no cryptography – it only reads the boolean results of prior approve calls and the isPublicIdentity flag bound at bindContract time. All proof verification happens during approve.

Consider Bob's AMM liquidity pool – a public BUCK account that processes swaps automatically. Over its lifetime, a million private accounts call approve(pool, amount, E_pool, proof) and then swap via transferFrom. Bob's pool contract never examines any counterparty's identity at the time of the swap. It doesn't need to: the EVM already verified every proof.

Eighteen months later, a regulator subpoenas Bob for Alice's identity – account #500,000 – in connection with a fraud investigation. How does Bob comply, and how does the on-chain record prove his pool wasn't complicit?

sequenceDiagram
    participant R as Regulator
    participant BW as Bob's Wallet
    participant ETH as Ethereum<br/>(archival node)
    participant HC as Holochain DHT

    R->>BW: Subpoena: identify account 0xAlice<br/>(transfer at block B_transfer)

    rect rgb(240, 248, 255)
    Note over BW,ETH: Step 1: Locate the proof chain
    BW->>ETH: Query ApproveReceipt events<br/>where spender=pool, owner=0xAlice
    ETH-->>BW: E_pool = (R', C') at block B_approve
    BW->>ETH: Query registration tx for 0xAlice
    ETH-->>BW: (A, B), E_alice, NIZK pi at block B_reg
    end

    rect rgb(255, 248, 240)
    Note over BW: Step 2: Decrypt
    BW->>BW: M = C' - sk_pool * R'
    end

    rect rgb(240, 255, 240)
    Note over BW,HC: Step 3: Recover plaintext
    alt identity_data in Bob's Private store
        BW->>BW: Read from local Holochain<br/>(if Bob verified at the time)
    else Retrieve from Alice or DHT
        BW->>HC: Request identity_data for agent<br/>(or regulator obtains from issuer)
    end
    BW->>BW: Verify: H(identity_data) * G == M
    end

    rect rgb(248, 240, 255)
    Note over BW,R: Step 4: Deliver evidence package
    BW->>R: Evidence package:<br/>1. identity_data (Alice's verified name)<br/>2. M = decrypted message point<br/>3. Block numbers: B_reg, B_approve, B_transfer<br/>4. On-chain tx hashes (independently verifiable)
    end

    Note over R: Regulator independently verifies:<br/>- Replay registration tx: NIZK valid at B_reg<br/>- Replay approve tx: Chaum-Pedersen valid at B_approve<br/>- Check issuer key was in TrustedIssuersRegistry at B_reg<br/>- Confirm H(identity_data) * G == M

The reference implementation in alberta_buck.wallet.issuer packages the same key generation behind a typed Issuer class. Wrapping the scalars produced above into an Issuer lets every later step in this document call the wallet API while keeping the keys identical to the raw-crypto example.

  from alberta_buck.wallet import Issuer, PSKeyPair

  ATB_ADDR = 0xa7b00000000000000000000000000000000a7b00
  issuer_obj = Issuer(
      issuer_id="atb-financial-ca",
      issuer_addr=ATB_ADDR,
      keypair=PSKeyPair(sk_x=isk_x, sk_y=isk_y, pk_X=IPK_X, pk_Y=IPK_Y, pk_Y1=IPK_Y1),
  )
  from alberta_buck.wallet import ps_key_consistent
  assert ps_key_consistent(issuer_obj.pk_X, issuer_obj.pk_Y, issuer_obj.pk_Y1)
  print(f"Wallet API: {issuer_obj.issuer_id!r} @ 0x{issuer_obj.issuer_addr:040x}")
  print(f"  pk_X, pk_Y, pk_Y1 match the raw points above; ps_key_consistent: True")

Wallet API: 'atb-financial-ca' @ 0xa7b00000000000000000000000000000000a7b00
  pk_X, pk_Y, pk_Y1 match the raw points above; ps_key_consistent: True

  import json

  # Alice's verified identity (canonical encoding -- field order matters)
  alice_identity_data = json.dumps({
      "given_name":    "Alice",
      "family_name":   "Johnson",
      "jurisdiction":  "Alberta, Canada",
      "id_type":       "Alberta Identity Card",
      "id_number":     "AIC-2026-4839201",
      "date_of_birth": "1992-03-15",
      "issuer_id":     "atb-financial-ca",
      "issued_at":     "2026-01-20T14:30:00Z",
      "epoch":         42
  }, sort_keys=True, separators=(',', ':'))

  print("Alice's identity_data (canonical JSON):")
  print(f"  {alice_identity_data[:72]}...")

Alice's identity_data (canonical JSON):
  {"date_of_birth":"1992-03-15","epoch":42,"family_name":"Johnson","given_...

The PS signature is \( \sigma = (h, (x + m \cdot y) \cdot h) \) where \( h \) is a random point in \( G_1 \).

  # Identity scalar: m = keccak256(ID_TAG || identity_data) mod ORDER
  m_alice = keccak(ID_TAG, alice_identity_data)

  # PS signature: pick random h, compute sigma = (h, (x + m*y) * h)
  t_h     = rand()
  h       = mul(G1, t_h)                     # random G_1 point
  sigma_2 = mul(h, (isk_x + m_alice * isk_y) % ORDER)
  sigma   = (h, sigma_2)

  print(f"Identity scalar m = H(identity_data):")
  print(f"  m = {m_alice}")
  print(f"PS signature sigma:")
  print(f"  sigma_1 = {pt(sigma[0])}")
  print(f"  sigma_2 = {pt(sigma[1])}")

Identity scalar m = H(identity_data):
  m = 2771514422476810872940980386877798997261510519897538008727794581922898236027
PS signature sigma:
  sigma_1 = (194876..., 629808...)
  sigma_2 = (909680..., 447485...)

The PS verification equation uses a bilinear pairing:

\[ e(\sigma_1, X + m \cdot Y) = e(\sigma_2, g_2) \]

What this proves: The issuer's signature is mathematically valid – it binds the identity scalar \( m \) to the issuer's secret key. If the signature passes, Alice can be sure the issuer actually certified her identity (no one else knows \( (x, y) \)).

  # Verify: e(sigma_1, X + m*Y) == e(sigma_2, g_2)
  lhs = pairing(add(IPK_X, mul(IPK_Y, m_alice)), sigma[0])
  rhs = pairing(G2, sigma[1])
  assert lhs == rhs, "PS signature verification FAILED"
  print("PS signature verified: e(sigma_1, X + m*Y) == e(sigma_2, g_2)")

  # The issuer gives Alice: (m, sigma, identity_data)
  # Alice stores all three in her Holochain Private entry
  print(f"\nIssuer gives Alice:")
  print(f"  m              = {m_alice}")
  print(f"  sigma          = (sigma_1, sigma_2)  -- PS signature")
  print(f"  identity_data  = '{alice_identity_data[:40]}...'")

PS signature verified: e(sigma_1, X + m*Y) == e(sigma_2, g_2)

Issuer gives Alice:
  m              = 2771514422476810872940980386877798997261510519897538008727794581922898236027
  sigma          = (sigma_1, sigma_2)  -- PS signature
  identity_data  = '{"date_of_birth":"1992-03-15","epoch":42...'

How to read the output: "PS signature verified" means both sides of the pairing equation produce the same element in \( G_T \). If \( m \) were wrong (e.g., tampered identity data), the two pairings would produce different \( G_T \) elements and the assertion would fail. A counter-example follows.

  # Tampered m -- what if someone changes one field in identity_data?
  m_fake = keccak(ID_TAG, "tampered_identity_data")
  lhs_bad = pairing(add(IPK_X, mul(IPK_Y, m_fake)), sigma[0])
  rhs_good = pairing(G2, sigma[1])
  ok = (lhs_bad == rhs_good)
  print(f"PS verify with wrong m: {ok}")
  print(f"  (The two G_T elements differ -- the pairing detects the mismatch.)")
  print(f"  Any change to identity_data produces a different m, which")
  print(f"  makes the pairing equation fail.  The signature is unforgeable.")

PS verify with wrong m: False
  (The two G_T elements differ -- the pairing detects the mismatch.)
  Any change to identity_data produces a different m, which
  makes the pairing equation fail.  The signature is unforgeable.

Issuer.issue(...) bundles the canonicalization, m computation, and PS signing into one call. ps_verify(...) performs the same pairing equation as the raw block above; the counter-example uses the same primitive against a tampered m.

  from alberta_buck.wallet import ps_verify, identity_scalar
  ALICE_ADDR = 0xa11ce00000000000000000000000000000a11ce

  alice_fields = {
      "given_name":    "Alice",
      "family_name":   "Johnson",
      "jurisdiction":  "Alberta, Canada",
      "id_type":       "Alberta Identity Card",
      "id_number":     "AIC-2026-4839201",
      "date_of_birth": "1992-03-15",
      "issuer_id":     "atb-financial-ca",
      "issued_at":     "2026-01-20T14:30:00Z",
      "epoch":         42,
  }
  cred = issuer_obj.issue(alice_fields, ALICE_ADDR, rng=rand)   # seeded: the transcript reproduces
  # Wallet computes m the same way: m = keccak256(ID_TAG || canonical) mod ORDER
  assert cred.m == identity_scalar(cred.canonical) == m_alice
  # PS verification, same pairing equation as the raw block:
  ok      = ps_verify(issuer_obj.pk_X, issuer_obj.pk_Y, cred.sigma, cred.m)
  ok_bad  = ps_verify(issuer_obj.pk_X, issuer_obj.pk_Y, cred.sigma, m_fake)
  print(f"Wallet API: cred.m == m_alice : {cred.m == m_alice}")
  print(f"  ps_verify(sigma, m_alice)   : {ok}")
  print(f"  ps_verify(sigma, m_fake)    : {ok_bad}")

Wallet API: cred.m == m_alice : True
  ps_verify(sigma, m_alice)   : True
  ps_verify(sigma, m_fake)    : False

Rerandomization, \( \sigma' = (t \sigma_1, t \sigma_2) \), yields a fresh valid signature on the same \( m \). It is the wallet's internal re-issuance step and nothing more: the pairing test \( e(\sigma'_1, X + m Y) = e(\sigma'_2, g_2) \) identifies it to anyone who knows \( m \). What the wallet publishes is the presentation

\[ A = a \cdot \sigma_1, \qquad B = a \cdot \sigma_2 + b \cdot Y_1 = (x + m y) \cdot A + b \cdot Y_1, \]

for fresh nonzero \( a, b \), where \( Y_1 = y \cdot G \) is the issuer's published \( G_1 \) key component. \( (A, B) \) satisfies the masked equation \( e(B, g_2) = e(A, X) \cdot e(mA + bG, Y) \) and no other: without \( b \) it is a uniform pair of points, the same distribution for every credential on every identity.

What this proves: the raw test succeeds on the rerandomized pair and fails on the presentation, for the true \( m \); the masked equation, which needs \( b \), holds for the presentation.

  from alberta_buck.wallet import ps_present

  # The raw test any holder of m can run on a published pair
  def raw_test(S1, S2, m):
      return pairing(add(IPK_X, mul(IPK_Y, m)), S1) == pairing(G2, S2)

  # Rerandomize (wallet-internal): still a signature on m_alice
  t_rerand = rand()
  sigma_p  = (mul(sigma[0], t_rerand), mul(sigma[1], t_rerand))
  print(f"Rerandomized pair: raw PS test with m_alice -> {raw_test(sigma_p[0], sigma_p[1], m_alice)}")
  print( "  (a candidate test for anyone holding m: never published)")

  # Present (published): (A, B) = (a*sigma_1, a*sigma_2 + b*Y1), fresh a, b
  pres_alice, a_alice, b_alice = ps_present(cred.sigma, issuer_obj.pk_Y1, rng=rand)
  A_alice, B_alice = pres_alice.A, pres_alice.B
  print(f"Presentation A = {pt(A_alice)}  B = {pt(B_alice)}")
  print(f"Presentation:      raw PS test with m_alice -> {raw_test(A_alice, B_alice, m_alice)}")

  # The masked equation holds -- but only with the blinding b
  P_alice = add(mul(A_alice, m_alice), mul(G1, b_alice))
  masked  = pairing(G2, B_alice) == pairing(IPK_X, A_alice) * pairing(IPK_Y, P_alice)
  print(f"Presentation:      masked equation with (m_alice, b) -> {masked}")

Rerandomized pair: raw PS test with m_alice -> True
  (a candidate test for anyone holding m: never published)
Presentation A = (554544..., 429626...)  B = (556214..., 843967...)
Presentation:      raw PS test with m_alice -> False
Presentation:      masked equation with (m_alice, b) -> True

How to read the output: Three lines to check. The rerandomized pair passes the raw test with Alice's \( m \): whoever holds \( m \) can identify it, which is why it stays in the wallet. The presentation fails the same test. The masked equation passes, but it needs \( b \), which only Alice's wallet holds for the instant of registration; the registration NIZK proves it without revealing it.

Alice generates a new key pair on alt_bn128 and encrypts her identity scalar \( m \) under her own public key using ElGamal:

\[ E_{\text{alice}} = (r \cdot G, \; m \cdot G + r \cdot pk_{\text{alice}}) \]

What this proves: Alice can encrypt her identity under her own public key and recover it. ElGamal decryption yields the point \( M = m \cdot G \), not the scalar \( m \) (solving the discrete log is infeasible).

  # Fresh identity key pair for this account
  sk_alice = rand()
  pk_alice = mul(G1, sk_alice)

  # ElGamal encryption of m under pk_alice
  r_enc   = rand()
  R_alice = mul(G1, r_enc)                           # R = r * G
  M_alice = mul(G1, m_alice)                          # M = m * G  (message point)
  C_alice = add(M_alice, mul(pk_alice, r_enc))        # C = m*G + r*pk
  E_alice = (R_alice, C_alice)

  print(f"Fresh key pair for this Ethereum account:")
  print(f"  sk_alice = {sk_alice}")
  print(f"  pk_alice = {pt(pk_alice)}")
  print(f"\nElGamal ciphertext E_alice = (R, C):")
  print(f"  R = r*G    = {pt(R_alice)}")
  print(f"  C = m*G+r*pk = {pt(C_alice)}")
  print(f"\nMessage point M = m*G:")
  print(f"  M = {pt(M_alice)}")

  # Verify Alice can decrypt her own ciphertext
  M_check = add(C_alice, neg(mul(R_alice, sk_alice)))  # C - sk*R = M
  assert eq(M_check, M_alice), "ElGamal self-decryption FAILED"
  print(f"\nAlice decrypts: C - sk*R = {pt(M_check)}  (matches M)")

Fresh key pair for this Ethereum account:
  sk_alice = 15971810906457614992647467534080057746179739969695951946612261292369424414341
  pk_alice = (528456..., 822195...)

ElGamal ciphertext E_alice = (R, C):
  R = r*G    = (888939..., 711304...)
  C = m*G+r*pk = (334292...,  55846...)

Message point M = m*G:
  M = (502436..., 889923...)

Alice decrypts: C - sk*R = (502436..., 889923...)  (matches M)

How to read the output: The last two lines show the decrypted point \( C - sk \cdot R \) and the original \( M \). Their coordinate fragments must match – this confirms the ciphertext is well-formed. If Alice used the wrong secret key, the decrypted point would be a random, unrelated point (shown in the counter-example below).

  sk_eve = rand()  # Eve's key, not Alice's
  M_wrong = add(C_alice, neg(mul(R_alice, sk_eve)))
  print(f"Eve decrypts with wrong key:")
  print(f"  M_wrong = {pt(M_wrong)}")
  print(f"  M_real  = {pt(M_alice)}")
  print(f"  Match: {eq(M_wrong, M_alice)}")
  print(f"  (Completely different point -- no information about m is leaked.)")

Eve decrypts with wrong key:
  M_wrong = (990549..., 173718...)
  M_real  = (502436..., 889923...)
  Match: False
  (Completely different point -- no information about m is leaked.)

Alice must prove, without revealing \( m \), \( b \), \( r \) or \( sk \), that:

• (a') \( (A, B) \) presents a valid PS credential on \( m \): \( e(B, g_2) = e(A, X) \cdot e(mA + bG, Y) \)
• (b) \( E_{\text{alice}} \) encrypts the same \( m \)
• (k) she holds \( sk \) for \( pk \)

This is a Schnorr-family sigma protocol with four nonces \( (\tilde m, \tilde b, \tilde r, \tilde{sk}) \) and four commitments: \( C_1 = \tilde m A + \tilde b G \) (one commitment for both credential exponents, so no proof field ever carries \( \tilde m A \) alone), \( T_C = \tilde m G + \tilde r\,pk \), \( T_R = \tilde r G \) and \( T_{key} = \tilde{sk}\,G \); the shared \( \tilde m \) is what joins the credential to the ciphertext. The Fiat-Shamir challenge binds the registrant address, the chain id, the registry address and the domain AlbertaBuck/FiatShamir/IdentityRegistry/Register/v2, so a proof cannot be replayed to another account, chain, registry or protocol version. The wallet's registration_prove is the executable specification – the Solidity, Rust and JavaScript verifiers are checked against its vectors – and it is the single registration path in this document.

  from alberta_buck.wallet import ElGamalCiphertext, registration_prove

  E_alice_w = ElGamalCiphertext(R=R_alice, C=C_alice)
  proof_w = registration_prove(
      pres_alice, b_alice, cred.m, r_enc, pk_alice, E_alice_w,
      ALICE_ADDR, sk_alice, rng=rand,
  )
  print("Registration proof pi = (e, s_m, s_b, s_r, s_sk, C1, T_C, T_R, T_key)")
  print(f"  e   = {proof_w.e}")
  print(f"  s_m = {proof_w.s_m}")
  print(f"  s_b = {proof_w.s_b}")
  print(f"  C1  = {pt(proof_w.C1)}   (m~*A + b~*G -- never m~*A on its own)")

Registration proof pi = (e, s_m, s_b, s_r, s_sk, C1, T_C, T_R, T_key)
  e   = 10200229377849831398463058862895386310125326660709570565200621111745915639032
  s_m = 9401951493053487559381785718431180115908812524446778252875344179764755185883
  s_b = 8283906936137015224805851135143136584723697294825212450496097817152055903462
  C1  = (752165..., 546410...)   (m~*A + b~*G -- never m~*A on its own)

Calldata is permanent and visible to every node, so the security of the identity layer rests on one principle: nothing submitted to the EVM is identity data, or a value that anyone – the issuer included – can test against identity data. The plaintext identity_data, the scalar \( m \), the point \( M = mG \), the raw credential \( \sigma \), the account secret \( sk \) and the blinding \( b \) never leave the wallet. Each of the five arguments of register is a public key, a ciphertext, a blinded pair or a masked scalar, and the contract only checks relations among them with pairings and scalar multiplications; it holds no key and decrypts nothing.

Two distinctions matter. The pre-A' design also kept identity_data off chain, but it published a rerandomized signature and a commitment \( \tilde m \sigma'_1 \) that were testable against a known \( m \); for anyone holding a candidate list, above all the issuer, a testable function of the identity is as revealing as the identity itself (review findings R1 and R2). The presentation and the single commitment \( C_1 \) remove that test; the appendix runs it both ways. And the guarantees differ in kind: the presentation and the proof hide \( m \) information-theoretically, while the ciphertext hides \( M \) only computationally, under DDH – the harvest-now-decrypt-later caveat the papers carry. The hiding of \( s_m \) also depends on the nonce \( \tilde m \) being fresh for every proof, which the wallet's sampler is responsible for; two proofs sharing a nonce would open \( m \) by one subtraction.

What this proves: the same \( m \) is presented in \( (A, B) \) and encrypted in \( E_{\text{alice}} \), and the registrant holds \( sk \) – without revealing \( m \), \( b \), \( r \) or \( sk \). Six checks run:

• (g) Guards: \( A \neq O \), \( B \neq O \), \( pk \neq O \), \( R \neq O \); all points on the curve; scalars canonical. \( A \neq O \) is security critical: at \( A = O \) the pairing product below holds for every \( m \).
• (fs) Fiat-Shamir: the challenge was honestly derived over \( (A, B, R, C, pk, C_1, T_C, T_R, T_{key}) \), the registrant, the chain id, the registry and the domain
• (b) ElGamal C consistency: the committed \( m \) is inside \( C \)
• (c) ElGamal R consistency: the committed \( r \) is inside \( R \)
• (k) Account key: the committed \( sk \) is the logarithm of \( pk \)
• (a') Pairing product: \( e(s_m A + s_b G - C_1, Y) \cdot e(eA, X) \cdot e(-eB, g_2) = 1 \)

  from alberta_buck.wallet.bn254 import point_to_words
  from alberta_buck.wallet.nizk import REGISTER_DOMAIN
  from alberta_buck.wallet.transcript import keccak_scalar

  # === VERIFIER (IdentityRegistry contract, on-chain) ===
  e_v, s_m_v, s_b_v, s_r_v, s_sk_v = (proof_w.e, proof_w.s_m, proof_w.s_b,
                                      proof_w.s_r, proof_w.s_sk)
  C1_v, T_C_v, T_R_v, T_key_v = proof_w.C1, proof_w.T_C, proof_w.T_R, proof_w.T_key
  CHAINID, REGISTRY = 1, 0     # the wallet's defaults; the contract uses its own

  # --- (g) guards ---
  assert not any(is_inf(P) for P in (A_alice, B_alice, pk_alice, R_alice))
  assert all(0 <= s_ < ORDER for s_ in (e_v, s_m_v, s_b_v, s_r_v, s_sk_v))
  print("(g)  guards passed: A, B, pk, R != O; scalars canonical")

  # --- (fs) Fiat-Shamir over the same words the contract hashes ---
  words = []
  for P in (A_alice, B_alice, R_alice, C_alice, pk_alice, C1_v, T_C_v, T_R_v, T_key_v):
      words += list(point_to_words(P))
  e_recomputed = keccak_scalar(*words, ALICE_ADDR, CHAINID, REGISTRY, REGISTER_DOMAIN)
  assert e_recomputed == e_v, "Fiat-Shamir challenge mismatch"
  print("(fs) Fiat-Shamir challenge verified (A, B, E, pk, commitments, registrant, chain, registry, domain)")

  # --- (b) ElGamal C consistency: s_m*G + s_r*pk == e*C + T_C ---
  assert eq(add(mul(G1, s_m_v), mul(pk_alice, s_r_v)), add(mul(C_alice, e_v), T_C_v))
  print("(b)  ElGamal C check passed: s_m*G + s_r*pk == e*C + T_C")

  # --- (c) ElGamal R consistency: s_r*G == e*R + T_R ---
  assert eq(mul(G1, s_r_v), add(mul(R_alice, e_v), T_R_v))
  print("(c)  ElGamal R check passed: s_r*G == e*R + T_R")

  # --- (k) account key: s_sk*G == T_key + e*pk ---
  assert eq(mul(G1, s_sk_v), add(T_key_v, mul(pk_alice, e_v)))
  print("(k)  account-key check passed: s_sk*G == T_key + e*pk")

  # --- (a') pairing product (what ecPairing computes: three pairs) ---
  lhs = add(add(mul(A_alice, s_m_v), mul(G1, s_b_v)), neg(C1_v))   # = e*(m*A + b*G)
  check = (
      pairing(IPK_Y, lhs)                       # e(s_m*A + s_b*G - C1, Y)
    * pairing(IPK_X, mul(A_alice, e_v))         # e(e*A, X)
    * pairing(G2,    neg(mul(B_alice, e_v)))    # e(-e*B, g_2)
  )
  assert check == FQ12_one(), "presentation pairing check FAILED"
  print("(a') pairing product passed:")
  print("     e(s_m*A + s_b*G - C1, Y) * e(e*A, X) * e(-e*B, g_2) == 1")

  # The only credential-side point anyone can derive from the proof:
  P_derived = mul(lhs, pow(e_v, -1, ORDER))
  assert eq(P_derived, P_alice)
  print("     derivable point P = m*A + b*G: uniform, and the same for every candidate m")
  print("\n==> Registration PASSED. isVerified(alice) = true")

(g)  guards passed: A, B, pk, R != O; scalars canonical
(fs) Fiat-Shamir challenge verified (A, B, E, pk, commitments, registrant, chain, registry, domain)
(b)  ElGamal C check passed: s_m*G + s_r*pk == e*C + T_C
(c)  ElGamal R check passed: s_r*G == e*R + T_R
(k)  account-key check passed: s_sk*G == T_key + e*pk
(a') pairing product passed:
e(s_m*A + s_b*G - C1, Y) * e(e*A, X) * e(-e*B, g_2) == 1
derivable point P = m*A + b*G: uniform, and the same for every candidate m

==> Registration PASSED. isVerified(alice) = true

How to read the output: All six checks must print "passed". If any assertion fires, the proof is invalid. The last line before the verdict names the one credential-side value an observer can compute from the proof: \( P = mA + bG \), which every candidate \( m_i \) explains equally well (as \( m_i A + (P - m_i A) \)), so the proof fields support no test on the identity. The pre-A' proof published \( \tilde m A \) as a separate commitment, from which \( mA \) followed by one subtraction.

  from alberta_buck.wallet import registration_verify

  # Forge: encrypt a fake m in ElGamal, but present the real credential
  r_fake  = rand()
  E_fake  = ElGamalCiphertext(R=mul(G1, r_fake),
                              C=add(mul(G1, m_fake), mul(pk_alice, r_fake)))
  proof_f = registration_prove(pres_alice, b_alice, cred.m, r_fake, pk_alice,
                               E_fake, ALICE_ADDR, sk_alice, rng=rand)
  ok_honest = registration_verify(pres_alice, E_alice_w, pk_alice,
                                  issuer_obj.pk_X, issuer_obj.pk_Y, proof_w, ALICE_ADDR)
  ok_forged = registration_verify(pres_alice, E_fake, pk_alice,
                                  issuer_obj.pk_X, issuer_obj.pk_Y, proof_f, ALICE_ADDR)
  # Replay of the honest proof to a different registrant address
  ok_replay = registration_verify(pres_alice, E_alice_w, pk_alice,
                                  issuer_obj.pk_X, issuer_obj.pk_Y, proof_w, ALICE_ADDR ^ 1)
  print(f"registration_verify(honest E_alice)             : {ok_honest}")
  print(f"registration_verify(E_fake encrypts m_fake)     : {ok_forged}")
  print(f"registration_verify(replayed to another address): {ok_replay}")

registration_verify(honest E_alice)             : True
registration_verify(E_fake encrypts m_fake)     : False
registration_verify(replayed to another address): False

Bob's KYC is the identical ceremony as Alice's, just with corporate fields and a different applicant address. Issuer.issue(...) produces a fresh sigma each call (random h per the PS spec) but verifies under the same issuer key.

  BOB_ADDR = 0x0b0b000000000000000000000000000000000b0b

  bob_fields = {
      "given_name":    "Bob",
      "family_name":   "Smith",
      "jurisdiction":  "Alberta, Canada",
      "id_type":       "Corporate Registration",
      "id_number":     "AB-CORP-2026-00182",
      "date_of_birth": "1985-07-22",
      "issuer_id":     "atb-financial-ca",
      "issued_at":     "2026-02-01T09:00:00Z",
      "epoch":         42,
  }
  cred_bob = issuer_obj.issue(bob_fields, BOB_ADDR, rng=rand)
  assert cred_bob.m == m_bob
  assert ps_verify(issuer_obj.pk_X, issuer_obj.pk_Y, cred_bob.sigma, cred_bob.m)
  print(f"Wallet API: cred_bob.m == m_bob    : {cred_bob.m == m_bob}")
  print(f"  ps_verify(cred_bob.sigma, m_bob) : True")
  print(f"  Issuer log now has 2 entries: {len(issuer_obj.issuance_log())}")

Wallet API: cred_bob.m == m_bob    : True
  ps_verify(cred_bob.sigma, m_bob) : True
  Issuer log now has 2 entries: 2

Alice decrypts her own ciphertext to recover \( M = m \cdot G \), then re-encrypts under Bob's public key with fresh randomness.

What this proves: Re-encryption preserves the message point \( M \). Bob can decrypt the new ciphertext with his own secret key and recover the same \( M \) that was in Alice's original ciphertext.

  # Alice decrypts her own credential
  M_decrypted = add(C_alice, neg(mul(R_alice, sk_alice)))  # C - sk*R = M
  assert eq(M_decrypted, M_alice), "Self-decryption failed"

  # Re-encrypt M under Bob's public key with fresh randomness r'
  r_prime   = rand()
  R_for_bob = mul(G1, r_prime)                         # R' = r' * G
  C_for_bob = add(M_alice, mul(pk_bob, r_prime))       # C' = M + r' * pk_bob
  E_for_bob = (R_for_bob, C_for_bob)

  print("Alice re-encrypts her identity for Bob:")
  print(f"  E_bob = (R', C') where:")
  print(f"    R' = r'*G     = {pt(R_for_bob)}")
  print(f"    C' = M+r'*pk  = {pt(C_for_bob)}")

  # Verify Bob can decrypt
  M_bob_decrypts = add(C_for_bob, neg(mul(R_for_bob, sk_bob)))
  assert eq(M_bob_decrypts, M_alice), "Bob cannot decrypt E_bob"
  print(f"\nBob decrypts: C' - sk_bob*R' = {pt(M_bob_decrypts)}")
  print(f"Matches Alice's M:             {pt(M_alice)}")

Alice re-encrypts her identity for Bob:
  E_bob = (R', C') where:
    R' = r'*G     = (550025..., 305708...)
    C' = M+r'*pk  = (544151..., 273588...)

Bob decrypts: C' - sk_bob*R' = (502436..., 889923...)
Matches Alice's M:             (502436..., 889923...)

How to read the output: The last two lines show Bob's decrypted point and Alice's original \( M \). The coordinate fragments must be identical – same point, different ciphertext wrapping it.

Alice proves that \( E_{\text{bob}} \) encrypts the same message point \( M \) as her registered \( E_{\text{alice}} \) – without revealing \( m \), \( sk_{\text{alice}} \) or the re-encryption randomness \( r' \). The statement has three relations, and all three are load-bearing:

\[ pk_{\text{alice}} = sk \cdot G, \qquad R_{\text{bob}} = r' \cdot G, \qquad C_{\text{alice}} - C_{\text{bob}} = sk \cdot R_{\text{alice}} - r' \cdot pk_{\text{bob}} . \]

The first binds the witness to Alice's registered key. Without it (the two-relation form an earlier version of this document showed) a sender who knows her own \( sk \) and \( r \) can choose a fake \( sk^\ast \) that makes \( C_{\text{alice}} - sk^\ast R_{\text{alice}} \) equal a third party's identity point, and hand Bob a ciphertext of that identity with an accepting proof (review finding 3). The wallet's chaum_pedersen_prove is the executable specification; its transcript binds (sender, spender, chainid, registry).

  from alberta_buck.wallet import chaum_pedersen_prove, chaum_pedersen_verify

  E_for_bob_w = ElGamalCiphertext(R=R_for_bob, C=C_for_bob)
  proof_cp = chaum_pedersen_prove(
      E_alice_w, E_for_bob_w, pk_alice, pk_bob,
      sk_alice, r_prime, ALICE_ADDR, BOB_ADDR, 1, rng=rand,
  )
  print("Chaum-Pedersen proof (e, s1, s2, T1, T2, T3):")
  print(f"  e  = {proof_cp.e}")
  print(f"  s1 = {proof_cp.s1}   (= a + e*sk)")
  print(f"  s2 = {proof_cp.s2}   (= b + e*r')")

Chaum-Pedersen proof (e, s1, s2, T1, T2, T3):
  e  = 19251208828704041191386349386691118550618987755341496292582267517772516785850
  s1 = 3741148286159627806704244734234946457958404415002544516963060844931866092536   (= a + e*sk)
  s2 = 20731108472805330455409911001868816179299309458904060820503057379286911627455   (= b + e*r')

The BUCK contract reads \( E_{\text{alice}} \) and \( pk_{\text{alice}} \) from the IdentityRegistry (never from calldata), then verifies the proof. (Its gas is not re-measured on this branch; the identity paper's figure of roughly 29K predates the three-relation repair.)

What this proves: \( E_{\text{alice}} \) and \( E_{\text{bob}} \) encrypt the same \( M \), and the prover holds the key registered as \( pk_{\text{alice}} \). Four checks:

• Check 1: \( s_1 G = T_1 + e\,pk_{\text{alice}} \) – the witness is Alice's registered key
• Check 2: \( s_2 G = T_3 + e\,R_{\text{bob}} \) – \( r' \) is consistent with \( R_{\text{bob}} \)
• Check 3: \( s_1 R_{\text{alice}} - s_2 pk_{\text{bob}} = T_2 + e (C_{\text{alice}} - C_{\text{bob}}) \) – same \( M \)
• Check 4: the Fiat-Shamir challenge was honestly derived

  # === VERIFIER (BUCK contract, on-chain) ===
  e_v, s1_v, s2_v = proof_cp.e, proof_cp.s1, proof_cp.s2
  T1, T2, T3 = proof_cp.T1, proof_cp.T2, proof_cp.T3

  assert eq(mul(G1, s1_v), add(T1, mul(pk_alice, e_v))), "check 1 FAILED"
  print("Check 1 passed: s1*G == T1 + e*pk_alice          (witness is the registered key)")
  assert eq(mul(G1, s2_v), add(T3, mul(R_for_bob, e_v))), "check 2 FAILED"
  print("Check 2 passed: s2*G == T3 + e*R_bob              (r' consistent with R_bob)")
  lhs = add(mul(R_alice, s1_v), neg(mul(pk_bob, s2_v)))
  rhs = add(T2, mul(add(C_alice, neg(C_for_bob)), e_v))
  assert eq(lhs, rhs), "check 3 FAILED"
  print("Check 3 passed: s1*R_a - s2*pk_b == T2 + e*(C_a - C_b)   (same M)")
  ok = chaum_pedersen_verify(E_alice_w, E_for_bob_w, pk_alice, pk_bob,
                             proof_cp, ALICE_ADDR, BOB_ADDR, 1)
  assert ok
  print(f"Check 4 passed: Fiat-Shamir challenge verified (wallet verifier agrees: {ok})")
  print("\n==> approve() PASSED. Alice's re-encrypted identity stored for Bob.")
  print("    _receiptFragments[alice][bob] = keccak256(E_bob)")

Check 1 passed: s1*G == T1 + e*pk_alice          (witness is the registered key)
Check 2 passed: s2*G == T3 + e*R_bob              (r' consistent with R_bob)
Check 3 passed: s1*R_a - s2*pk_b == T2 + e*(C_a - C_b)   (same M)
Check 4 passed: Fiat-Shamir challenge verified (wallet verifier agrees: True)

==> approve() PASSED. Alice's re-encrypted identity stored for Bob.
    _receiptFragments[alice][bob] = keccak256(E_bob)

How to read the output: All four "passed" lines must appear. The two counter-examples below each break exactly one of them.

  # Alice tries to re-encrypt a DIFFERENT M (e.g., someone else's identity)
  m_other = rand()
  M_other = mul(G1, m_other)
  r_bad   = rand()
  R_bad   = mul(G1, r_bad)
  C_bad   = add(M_other, mul(pk_bob, r_bad))     # encrypts M_other, not M_alice
  E_bad_w = ElGamalCiphertext(R=R_bad, C=C_bad)
  proof_bad = chaum_pedersen_prove(E_alice_w, E_bad_w, pk_alice, pk_bob,
                                   sk_alice, r_bad, ALICE_ADDR, BOB_ADDR, 1, rng=rand)
  lhs = add(mul(R_alice, proof_bad.s1), neg(mul(pk_bob, proof_bad.s2)))
  rhs = add(proof_bad.T2, mul(add(C_alice, neg(C_bad)), proof_bad.e))
  print(f"Forged re-encryption -- Check 3 (same M)   : {eq(lhs, rhs)}")
  ok_bad = chaum_pedersen_verify(E_alice_w, E_bad_w, pk_alice, pk_bob,
                                 proof_bad, ALICE_ADDR, BOB_ADDR, 1)
  print(f"Forged re-encryption -- wallet verifier    : {ok_bad}")
  print( "  (FAILS: C_bad encrypts a different M than C_alice; approve() reverts.)")

Forged re-encryption -- Check 3 (same M)   : False
Forged re-encryption -- wallet verifier    : False
  (FAILS: C_bad encrypts a different M than C_alice; approve() reverts.)

  from alberta_buck.review.examples import false_identity_approval
  from alberta_buck.wallet import elgamal_decrypt

  alice_r, bob_r, victim_m, fake_sk, r_star, forged, proof_x = false_identity_approval(
      ALICE_ADDR, BOB_ADDR, 1)
  # Bob would decrypt the forged ciphertext to the VICTIM's identity point
  print(f"forged E decrypts (under sk_bob) to victim's M : "
        f"{eq(elgamal_decrypt(forged, bob_r.sk), mul(G1, victim_m))}")
  print(f"fake witness sk* is Alice's registered key     : {eq(mul(G1, fake_sk), alice_r.pk)}")
  c2 = eq(mul(G1, proof_x.s2), add(proof_x.T3, mul(forged.R, proof_x.e)))
  c3 = eq(add(mul(alice_r.E.R, proof_x.s1), neg(mul(bob_r.pk, proof_x.s2))),
          add(proof_x.T2, mul(add(alice_r.E.C, neg(forged.C)), proof_x.e)))
  c1 = eq(mul(G1, proof_x.s1), add(proof_x.T1, mul(alice_r.pk, proof_x.e)))
  print(f"Checks 2 and 3 (the two-relation protocol)     : {c2 and c3}")
  print(f"Check 1 (witness == registered key)            : {c1}")
  ok_x = chaum_pedersen_verify(alice_r.E, forged, alice_r.pk, bob_r.pk, proof_x,
                               ALICE_ADDR, BOB_ADDR, 1)
  print(f"wallet verifier (three relations)              : {ok_x}")

forged E decrypts (under sk_bob) to victim's M : True
fake witness sk* is Alice's registered key     : False
Checks 2 and 3 (the two-relation protocol)     : True
Check 1 (witness == registered key)            : False
wallet verifier (three relations)              : False

If a man-in-the-middle alters the identity data in transit, Bob detects it immediately – the hash no longer matches the on-chain point:

  # Someone tampers with the identity data in transit
  tampered = alice_identity_data.replace("Alice", "Mallory")
  m_tampered = keccak(ID_TAG, tampered)
  M_tampered = mul(G1, m_tampered)

  print(f"Tampered identity_data: ...given_name: 'Mallory'...")
  print(f"  H(tampered) * G = {pt(M_tampered)}")
  print(f"  M (from chain)  = {pt(M_from_bob)}")
  print(f"  Match: {eq(M_tampered, M_from_bob)}")
  print(f"  (Bob rejects: the off-chain data doesn't match the on-chain point.)")

Tampered identity_data: ...given_name: 'Mallory'...
  H(tampered) * G = (953842..., 633816...)
  M (from chain)  = (502436..., 889923...)
  Match: False
  (Bob rejects: the off-chain data doesn't match the on-chain point.)

ElGamal encryption of a group element \( M = g^m \) under public key \( pk = g^{sk} \) with randomness \( r \):

  import hashlib

  p = 23;  q = 11;  g = 4     # safe prime, prime-order subgroup

  def mod_exp(base, exp, mod):
      result = 1
      base = base % mod
      while exp > 0:
          if exp & 1:
              result = (result * base) % mod
          base = (base * base) % mod
          exp >>= 1
      return result

  def mod_inv(a, mod):
      def egcd(a, b):
          if a == 0: return b, 0, 1
          g, x, y = egcd(b % a, a)
          return g, y - (b // a) * x, x
      _, x, _ = egcd(a % mod, mod)
      return x % mod

  def fs_hash(*args):
      """Fiat-Shamir: H(args...) mod q"""
      h = hashlib.sha256()
      for a in args:
          h.update(str(a).encode())
      return int(h.hexdigest(), 16) % q

  # Identity
  m = 3;  M = mod_exp(g, m, p)

  # Keys
  sk_a = 5;  pk_a = mod_exp(g, sk_a, p)
  sk_b = 7;  pk_b = mod_exp(g, sk_b, p)

  # Encrypt for Alice (r_a=2) and Bob (r_b=9)
  r_a = 2;  R_a = mod_exp(g, r_a, p)
  C_a = (M * mod_exp(pk_a, r_a, p)) % p

  r_b = 9;  R_b = mod_exp(g, r_b, p)
  C_b = (M * mod_exp(pk_b, r_b, p)) % p

  # Decrypt both
  dec_a = (C_a * mod_inv(mod_exp(R_a, sk_a, p), p)) % p
  dec_b = (C_b * mod_inv(mod_exp(R_b, sk_b, p), p)) % p

  [
      ["", "m", "M=g^m", "sk", "pk", "r", "R=g^r", "C=M*pk^r", "Decrypted"],
      None,
      ["Alice", m, M, sk_a, pk_a, r_a, R_a, C_a, dec_a],
      ["Bob",   m, M, sk_b, pk_b, r_b, R_b, C_b, dec_b],
  ]

Same message \( M = 18 \) in both ciphertexts: \( (16, 16) \) for Alice, \( (13, 1) \) for Bob. Different randomness makes them unlinkable.

At registration, Alice proves she knows the plaintext \( m \) and randomness \( r \) inside her ElGamal ciphertext – without revealing either. (In the full protocol, a Pointcheval-Sanders pairing check additionally binds \( m \) to the issuer's signature; this demonstration isolates the sigma-protocol core.)

  # Prove knowledge of (m=3, r=2) in E_alice = (16, 16)
  k_m = 1;  k_r = 1                                           # random nonces
  T_R = mod_exp(g, k_r, p)                                    # 4
  T_C = (mod_exp(g, k_m, p) * mod_exp(pk_a, k_r, p)) % p      # 2

  e = fs_hash(g, pk_a, R_a, C_a, T_R, T_C)                    # 8

  s_m = (k_m - e * m) % q                                     # 10
  s_r = (k_r - e * r_a) % q                                   # 7

  chk1 = (mod_exp(g, s_r, p) * mod_exp(R_a, e, p)) % p
  chk2 = (mod_exp(g, s_m, p) * mod_exp(pk_a, s_r, p) * mod_exp(C_a, e, p)) % p

  print(f"Commit:    T_R = {T_R},  T_C = {T_C}")
  print(f"Challenge: e = {e}")
  print(f"Respond:   s_m = {s_m},  s_r = {s_r}")
  print(f"Verify 1:  g^s_r * R^e  = {chk1:2}          == T_R={T_R:2}  {'PASS' if chk1 == T_R else 'FAIL'}")
  print(f"Verify 2:  g^s_m * pk^s_r * C^e = {chk2:2}  == T_C={T_C:2}  {'PASS' if chk2 == T_C else 'FAIL'}")

  # Counter-example: Alice claims m'=5 (wrong identity)
  m_fake = 5
  s_m_fake = (k_m - e * m_fake) % q
  chk2_f = (mod_exp(g, s_m_fake, p) * mod_exp(pk_a, s_r, p) * mod_exp(C_a, e, p)) % p
  print(f"\nCounter-example (m'={m_fake}):")
  print(f"  Verify 2:  {chk2_f}  == T_C={T_C}  {'PASS' if chk2_f == T_C else 'FAIL'}")
  print(f"  The ciphertext encrypts m={m}, not m'={m_fake}.")
  print(f"  No response value can bridge the gap.")

Commit:    T_R = 4,  T_C = 2
Challenge: e = 8
Respond:   s_m = 10,  s_r = 7
Verify 1:  g^s_r * R^e  =  4          == T_R= 4  PASS
Verify 2:  g^s_m * pk^s_r * C^e =  2  == T_C= 2  PASS

Counter-example (m'=5):
  Verify 2:  4  == T_C=2  FAIL
  The ciphertext encrypts m=3, not m'=5.
  No response value can bridge the gap.

How it works: The prover commits to random nonces \( k_m, k_r \) before seeing the challenge \( e \). Only someone who knows the real \( m \) and \( r \) can produce responses that satisfy both equations for the specific \( e \) the Fiat-Shamir hash generates. Check 1 confirms knowledge of \( r \); Check 2 confirms knowledge of \( m \) and its consistency with the ciphertext. A wrong \( m' \) produces a wrong \( s_m \), which ripples through the multi-exponentiation in Check 2.

At approve time, Alice re-encrypts her identity for Bob and proves both ciphertexts contain the same \( M \) – without revealing it. Three independent checks verify her key ownership, her knowledge of the new randomness, and the binding constraint that the decrypted values match.

  # Prove E_alice=(16,16) and E_bob=(13,1) encrypt the same M
  k1 = 1;  k2 = 1
  T1 = mod_exp(g, k1, p)                                            # 4
  T2 = mod_exp(g, k2, p)                                            # 4
  T3 = (mod_exp(pk_b, k2, p) * mod_exp(R_a, (q - k1) % q, p)) % p  # 12

  e_cp = fs_hash(g, pk_a, pk_b, R_a, C_a, R_b, C_b, T1, T2, T3)   # 4

  s1 = (k1 - e_cp * sk_a) % q                                      # 3
  s2 = (k2 - e_cp * r_b) % q                                       # 9

  v1 = (mod_exp(g, s1, p) * mod_exp(pk_a, e_cp, p)) % p
  v2 = (mod_exp(g, s2, p) * mod_exp(R_b, e_cp, p)) % p
  cb_ca = (C_b * mod_inv(C_a, p)) % p
  v3 = (mod_exp(pk_b, s2, p) * mod_exp(R_a, (q - s1) % q, p)
        * mod_exp(cb_ca, e_cp, p)) % p

  print(f"Commit:    T1={T1},  T2={T2},  T3={T3}")
  print(f"Challenge: e = {e_cp}")
  print(f"Respond:   s1={s1},  s2={s2}")
  print(f"Verify 1 (owns pk_a):    {v1:2} == T1={T1:2}  {'PASS' if v1 == T1 else 'FAIL'}")
  print(f"Verify 2 (knows r_b):    {v2:2} == T2={T2:2}  {'PASS' if v2 == T2 else 'FAIL'}")
  print(f"Verify 3 (same M):       {v3:2} == T3={T3:2}  {'PASS' if v3 == T3 else 'FAIL'}")

  # Counter-example: Alice encrypts M'=g^7=8 instead of M=g^3=18
  m_bad = 7;  M_bad = mod_exp(g, m_bad, p)
  C_b_bad = (M_bad * mod_exp(pk_b, r_b, p)) % p
  e_bad = fs_hash(g, pk_a, pk_b, R_a, C_a, R_b, C_b_bad, T1, T2, T3)
  s1_b = (k1 - e_bad * sk_a) % q
  s2_b = (k2 - e_bad * r_b) % q
  v1_b = (mod_exp(g, s1_b, p) * mod_exp(pk_a, e_bad, p)) % p
  v2_b = (mod_exp(g, s2_b, p) * mod_exp(R_b, e_bad, p)) % p
  cb_ca_b = (C_b_bad * mod_inv(C_a, p)) % p
  v3_b = (mod_exp(pk_b, s2_b, p) * mod_exp(R_a, (q - s1_b) % q, p)
          * mod_exp(cb_ca_b, e_bad, p)) % p

  print(f"\nCounter-example (M'=g^{m_bad}={M_bad}, C_b'={C_b_bad}):")
  print(f"  Verify 1 (owns pk_a):  {v1_b:2} == T1={T1:2}  {'PASS' if v1_b == T1 else 'FAIL'}")
  print(f"  Verify 2 (knows r_b):  {v2_b:2} == T2={T2:2}  {'PASS' if v2_b == T2 else 'FAIL'}")
  print(f"  Verify 3 (same M):     {v3_b:2} == T3={T3:2}  {'PASS' if v3_b == T3 else 'FAIL'}")
  print(f"  Alice owns her key and knows r_b -- checks 1,2 pass.")
  print(f"  But E_alice encrypts M={M} while E_bob encrypts M'={M_bad}.")