// pvss_engine.ts
// Publicly Verifiable Secret Sharing (Schoenmakers Scheme)
// 100% Non-Interactive Zero-Knowledge Proofs of Share Validity

export interface PVSSDealerPackage {
  commitments: bigint[]; // C_j = g^{a_j}
  encryptedShares: bigint[]; // Y_i = y_i^{s_i}
  proofs: { a: bigint; b: bigint; r: bigint; c: bigint }[];
}

export class PVSS {
  private p: bigint; // Field prime
  private q: bigint; // Subgroup order
  private g: bigint; // Generator

  constructor(p: bigint, q: bigint, g: bigint) {
    this.p = p; this.q = q; this.g = g;
  }

  // Public verification executable by ANY third party or smart contract
  verifyShare(
    participantIndex: number,
    publicKeyY: bigint,
    encryptedShareY: bigint,
    commitmentsC: bigint[],
    proof: { a: bigint; b: bigint; r: bigint; c: bigint }
  ): boolean {
    const i = BigInt(participantIndex);
    
    // 1. Compute expected public share value X_i = prod_{j=0}^{t-1} C_j^{i^j} mod p
    let X_i = 1n;
    let iPow = 1n;
    for (const C_j of commitmentsC) {
      const term = this.modExp(C_j, iPow, this.p);
      X_i = (X_i * term) % this.p;
      iPow = (iPow * i) % this.q;
    }

    // 2. Verify Chaum-Pedersen DLEQ Equations:
    // a_i == g^{r_i} * X_i^c mod p
    const checkA = (this.modExp(this.g, proof.r, this.p) * this.modExp(X_i, proof.c, this.p)) % this.p;
    if (checkA !== proof.a) return false;

    // b_i == y_i^{r_i} * Y_i^c mod p
    const checkB = (this.modExp(publicKeyY, proof.r, this.p) * this.modExp(encryptedShareY, proof.c, this.p)) % this.p;
    return checkB === proof.b;
  }

  private modExp(base: bigint, exp: bigint, mod: bigint): bigint {
    let res = 1n;
    base = base % mod;
    let e = exp;
    while (e > 0n) {
      if (e & 1n) res = (res * base) % mod;
      base = (base * base) % mod;
      e >>= 1n;
    }
    return res;
  }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

// On-Chain Public Verifier for PVSS Shares (e.g. MEV-resistant threshold mempool)
contract PVSSVerifier {
    uint256 constant P = 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47; // bn254 base
    
    function verifyShareProof(
        uint256 g,
        uint256 pubKeyY,
        uint256 encShareY,
        uint256 targetX,
        uint256 a,
        uint256 b,
        uint256 r,
        uint256 c
    ) external view returns (bool) {
        // Check equation 1: a == g^r * X^c mod P
        uint256 gr = mulmodExp(g, r, P);
        uint256 xc = mulmodExp(targetX, c, P);
        if (mulmod(gr, xc, P) != a) return false;

        // Check equation 2: b == y^r * Y^c mod P
        uint256 yr = mulmodExp(pubKeyY, r, P);
        uint256 yc = mulmodExp(encShareY, c, P);
        return mulmod(yr, yc, P) == b;
    }

    function mulmodExp(uint256 base, uint256 exp, uint256 mod) internal view returns (uint256 result) {
        // Call BN254 / ModExp precompile at 0x05
        bytes memory input = abi.encodePacked(uint256(32), uint256(32), uint256(32), base, exp, mod);
        bytes memory out = new bytes(32);
        assembly {
            if iszero(staticcall(gas(), 0x05, add(input, 32), mload(input), add(out, 32), 32)) {
                revert(0, 0)
            }
            result := mload(add(out, 32))
        }
    }
}

Schoenmakers Publicly Verifiable Secret Sharing (PVSS) Protocol

Phase 1: Distribution
1. Dealer chooses random polynomial f(X) = s + a_1 X + ... + a_{t-1} X^{t-1} mod q.
2. Dealer commits to coefficients: C_j = g^{a_j} in G for j in [0..t-1].
3. For each participant P_i:
   - Secret share: s_i = f(i) mod q
   - Encrypted share: Y_i = (y_i)^{s_i} in G (where y_i = g^{x_i})
   - Compute public target: X_i = prod_{j=0}^{t-1} (C_j)^{i^j} = g^{s_i}
   - Produce NIZK DLEQ proof that log_{y_i}(Y_i) == log_g(X_i).

Phase 2: Verification (Public)
Any external observer verifies for all i in [1..n]:
   DLEQ_Verify(g, y_i, X_i, Y_i, Proof_i) == true.

Phase 3: Reconstruction
Any subset T of t participants publish decrypted share S_i = (Y_i)^{1/x_i} = g^{s_i}.
Each participant proves log_g(y_i) == log_{S_i}(Y_i).
Reconstructed public secret: S = g^s = prod_{i in T} (S_i)^{lambda_i(0)}.