Verifiable

Cryptographic proof of membership in a set without revealing which member produced the proof. Built on ring VRFs, it provides unlinkable, deterministic pseudonymic aliases under each context.

A member proves they belong to a group (identified by a Members commitment) under a given context, producing a Proof and a context-specific Alias. Different contexts yield unlinkable aliases for the same member. An optional message can be bound to the proof.

Core trait

The [Verifiable] trait defines the full API:

• Ring construction: start_members / push_members / finish_members build a Members commitment from public keys.
• Proof creation (prover-side, behind the prover feature): open prepares a commitment, then create (single context) or create_multi_context (multiple contexts in one proof) produces the proof and alias(es).
• Proof validation: validate / validate_multi_context verify a proof and return the alias(es). batch_validate verifies multiple independent proofs efficiently in a single all-or-nothing batched check; batch_validate_per_item additionally attributes failures, reporting a per-item outcome so one invalid proof does not affect the others. Each BatchProofItem carries its own config and members, so a batch may mix proofs from different rings, even rings of different sizes.
• Plain signatures: sign / verify_signature for non-anonymous signatures attributable to a specific member.

A [Receipt] convenience type bundles a proof with its alias and message for the common single-context workflow.

Implementation

The provided implementation uses the Bandersnatch curve (BLS12-381 pairing) via ark-vrf:

• RingVrfVerifiable<S> -- generic over any RingSuiteExt suite
• BandersnatchVrfVerifiable -- concrete type alias for the Bandersnatch suite

Ring capacity is configured via RingDomainSize (2^11, 2^12, or 2^16), supporting up to 16127 members.

Features

Feature	Description
std (default)	Enables prover, secret-split, std support, and parallel proving
prover	Proof generation (open, create, create_multi_context)
secret-split	Side-channel-resistant secret scalar multiplication (masks the secret before EC multiplication). Requires a system RNG, so it is only enabled under std
builder-params	Includes precomputed ring builder params for building ring commitments
no-std-prover	Proof generation in no_std, with zero-knowledge blinding intact. Blinding randomness goes through getrandom; targets without an OS entropy source (e.g. wasm runtimes) must register a backend with getrandom::register_custom_getrandom!. A missing backend fails at link time
mock	Exposes the mock module with a non-cryptographic Mock implementation for tests

For verifier-only builds (e.g. on-chain), disable default features.

License

GPL-3.0-or-later WITH Classpath-exception-2.0