An experimental Rust implementation of the Triptych zero-knowledge proving system.

Triptych is a zero-knowledge proving system designed to function as a linkable ring signature. This is a construction that allows a signer to sign a message against a set of arbitrary verification keys. Successful verification of a signature means that the signer knew the signing key corresponding to one of the verification keys, but does not reveal which. It also produces a linking tag; if any two verified signatures have the same linking tag, they were produced using the same signing key. However, it is not possible to determine the signing key associated to a linking tag, nor the corresponding verification key.

More formally, let G and U be fixed independent generators of the Ristretto group. Let N = n**m, where n, m > 1 are fixed parameters. The Triptych proving system protocol is a sigma protocol for the following relation, where M is an N-vector of group elements:

{ M, J ; (l, r) : M[l] = r*G, r*J = U }

It's possible to use the Fiat-Shamir transformation to produce a non-interactive protocol that can additionally bind an arbitrary message into the proof. This produces the linkable ring signature.

This implementation makes several opinionated choices:

• It uses Ristretto for group operations.
• It uses Merlin for Fiat-Shamir transcript operations.
• It uses BLAKE3 for other cryptographic hashing operations.

It's possible to generalize these if done safely, but the implementation doesn't (yet) do this.

The implementation keeps dependencies to a minimum, and is no_std right out of the box. You can enable the optional serde feature for proof (de)serialization support.

The implementation uses zeroize to securely wipe the signing key r after use. However, it does not do so for the index l.

Care is taken to keep signing key operations constant time to avoid leaking key data. However, index-related operations may not be constant time.

While this implementation is written with security in mind, it is currently experimental and not suitable for production use.