Fix oracle simulation in RPA-RE.

1 files changed, 23 insertions, 10 deletions

diff --git a/re/rpa.ipynb b/re/rpa.ipynb
index 5bfbdd6..dc04a58 100644
--- a/re/rpa.ipynb
+++ b/re/rpa.ipynb
@@ -149,9 +149,7 @@
    "cell_type": "code",
    "execution_count": null,
    "id": "44e7e2e9-e0ad-4c8d-8605-af68f73d73e2",
-   "metadata": {
-    "scrolled": true
-   },
+   "metadata": {},
    "outputs": [],
    "source": [
     "scalar = 0b1000000000000000000000000000000000000000000000000\n",
@@ -274,7 +272,9 @@
     "\n",
     "### Oracle simulation\n",
     "The `simulated_oracle` function simulates an RPA oracle that detect a zero coordinate point in the scalar multiplication.\n",
-    "This can be used by the `rpa_distinguish` function to distinguish the true scalar multiplier. The oracle is parametrized with the simulated multiplier index in the table of multipliers (it simulates this \"real\" multiplier). Furthermore, lets also examine a `noisy_oracle` (with a flip probability) and a `biased_oracle` (with asymmetric flip probability)."
+    "This can be used by the `rpa_distinguish` function to distinguish the true scalar multiplier. The oracle is parametrized with the simulated multiplier index in the table of multipliers (it simulates this \"real\" multiplier). Furthermore, lets also examine a `noisy_oracle` (with a flip probability) and a `biased_oracle` (with asymmetric flip probability).\n",
+    "\n",
+    "Note that the oracle has two additional parameters `measure_init` and `measure_multiply` which determine whether the oracle considers the zero coordinate point in scalar multiplier initialization (precomputation) and in scalar multiplier multiplication, respectively. This is important for scalar multipliers with precomputation as there one might be able to separate the precomputation and multiplication stages and obtain oracle answers on both separately."
    ]
   },
   {
@@ -284,13 +284,26 @@
    "metadata": {},
    "outputs": [],
    "source": [
-    "def simulated_oracle(scalar, affine_point, simulate_mult_id=0):\n",
+    "def simulated_oracle(scalar, affine_point, simulate_mult_id=0, measure_init=True, measure_multiply=True, randomize=False):\n",
     "    real_mult = multipliers[simulate_mult_id]\n",
-    "    point = affine_point.to_model(p256.curve.coordinate_model, p256.curve)\n",
+    "    point = affine_point.to_model(params.curve.coordinate_model, params.curve, randomized=randomize)\n",
+    "    \n",
+    "    # Simulate the multiplier init\n",
     "    with local(MultipleContext()) as ctx:\n",
-    "        real_mult.init(p256, point)\n",
+    "        real_mult.init(params, point)\n",
+    "    init_points = set(ctx.parents.keys())\n",
+    "    init_parents = set(sum((ctx.parents[point] for point in init_points), []))\n",
+    "    # Did zero happen in some input point during the init?\n",
+    "    init_zero = any(map(lambda P: P.X == 0 or P.Y == 0, init_parents))\n",
+    "    \n",
+    "    # Simulate the multiplier multiply\n",
+    "    with local(ctx) as ctx:\n",
     "        real_mult.multiply(scalar)\n",
-    "    real_result = any(map(lambda P: P.X == 0 or P.Y == 0, ctx.points.keys()))\n",
+    "    all_points = set(ctx.parents.keys())\n",
+    "    multiply_parents = set(sum((ctx.parents[point] for point in all_points - init_points), []))\n",
+    "    # Did zero happen in some input point during the multiply?\n",
+    "    multiply_zero = any(map(lambda P: P.X == 0 or P.Y == 0, multiply_parents))\n",
+    "    real_result = (init_zero and measure_init) or (multiply_zero and measure_multiply)\n",
     "    return real_result\n",
     "\n",
     "def noisy_oracle(oracle, flip_proba=0):\n",
@@ -324,7 +337,7 @@
    "outputs": [],
    "source": [
     "p256 = get_params(\"secg\", \"secp256r1\", \"projective\")\n",
-    "res = rpa_distinguish(p256, multipliers, simulated_oracle)"
+    "res = rpa_distinguish(params, multipliers, simulated_oracle)"
    ]
   },
   {
@@ -607,7 +620,7 @@
    "name": "python",
    "nbconvert_exporter": "python",
    "pygments_lexer": "ipython3",
-   "version": "3.11.5"
+   "version": "3.11.4"
   }
  },
  "nbformat": 4,