scheme.spec.ts

import {
  BBDT16MacProofOfValidity,
  CompositeProof,
  createWitnessEqualityMetaStatement,
  Encoder,
  encodeRevealedMsgs,
  getAdaptedSignatureParamsForMessages,
  getIndicesForMsgNames,
  getRevealedAndUnrevealed,
  initializeWasm,
  isValidMsgStructure,
  MetaStatements,
  ProofSpec,
  Statement,
  Statements,
  Witness,
  WitnessEqualityMetaStatement,
  Witnesses
} from '../../../src';
import { PederCommKey } from '../../../src/ped-com';
import { buildWitness, isBBDT16, isKvac, Scheme } from '../../scheme';
import { checkResult, getParamsAndKeys, stringToBytes } from '../../utils';
import {
  attributes1,
  attributes1Struct,
  attributes2,
  attributes2Struct,
  attributes3,
  attributes3Struct,
  defaultEncoder
} from './data-and-encoder';
import { checkMapsEqual, signedToHex } from './index';
import { proverStmt, signAndVerify, verifierStmt } from './util';

describe(`Signing and proof of knowledge of ${Scheme} signatures`, () => {
  // NOTE: The following tests contain a lot of duplicated code but that is intentional as this code is for illustration purpose.

  beforeAll(async () => {
    // Load the WASM module
    await initializeWasm();
  });

  it('signing and proof of knowledge of a signature', () => {
    // This test check that a single signature can be produced and verified and proof of knowledge of signature can be
    // done while revealing only some attributes (selective-disclosure). Nested attributes are separated by a "dot" (.)

    const label = stringToBytes('Sig params label - this is public');
    // Message count shouldn't matter as `label` is known
    const [params, sk, pk] = getParamsAndKeys(100, label);

    // The encoder has to be known and agreed upon by all system participants, i.e. signer, prover and verifier.
    const encoder = new Encoder(undefined, defaultEncoder);

    let i = 1;
    for (const [attributes, attributesStruct, revealedAttributeNames] of [
      [attributes1, attributes1Struct, ['fname', 'country']],
      [attributes2, attributes2Struct, ['lname', 'location.country', 'physical.weight']],
      [
        attributes3,
        attributes3Struct,
        ['fname', 'lessSensitive.department.name', 'lessSensitive.department.location.name']
      ]
    ]) {
      expect(isValidMsgStructure(attributes, attributesStruct)).toEqual(true);

      const signed = signAndVerify(attributes, encoder, label, sk, pk);
      if (isBBDT16()) {
        const pk = sk.generatePublicKeyG1(params);
        const proof = new BBDT16MacProofOfValidity(signed.signature, sk, pk, params);
        checkResult(proof.verifyWithMessageObject(signed.signature, attributes, pk, label, encoder));
      }

      // For debugging
      console.log(signedToHex(signed));

      const revealedNames = new Set<string>();
      // @ts-ignore
      revealedAttributeNames.forEach((n: string) => {
        revealedNames.add(n);
      });

      // Both prover and verifier can independently create this struct
      const sigParams = getAdaptedSignatureParamsForMessages(params, attributesStruct);

      // Prover prepares messages it wishes to reveal and hide.

      const [revealedMsgs, unrevealedMsgs, revealedMsgsRaw] = getRevealedAndUnrevealed(
        attributes,
        revealedNames,
        encoder
      );

      // `revealedMsgsRaw` contains the messages being revealed without the values being encoded. The idea is for the
      // verifier to encode it independently.
      if (i === 1) {
        expect(revealedMsgsRaw).toEqual({ fname: 'John', country: 'USA' });
      }

      if (i === 2) {
        expect(revealedMsgsRaw).toEqual({
          lname: 'Smith',
          location: {
            country: 'USA'
          },
          physical: {
            weight: 210
          }
        });
      }

      if (i == 3) {
        expect(revealedMsgsRaw).toEqual({
          fname: 'John',
          lessSensitive: {
            department: {
              name: 'Random',
              location: {
                name: 'Somewhere'
              }
            }
          }
        });
      }

      const statement1 = proverStmt(
        sigParams,
        revealedMsgs,
        pk
      );
      const statementsProver = new Statements();
      statementsProver.add(statement1);

      // The prover should independently construct this `ProofSpec`
      const proofSpecProver = new ProofSpec(statementsProver, new MetaStatements());
      expect(proofSpecProver.isValid()).toEqual(true);

      const witness1 = buildWitness(signed.signature, unrevealedMsgs, false);
      const witnesses = new Witnesses();
      witnesses.add(witness1);

      const proof = CompositeProof.generate(proofSpecProver, witnesses);
      // For debugging
      console.log(proof.hex);

      // Verifier independently encodes revealed messages
      const revealedMsgsFromVerifier = encodeRevealedMsgs(revealedMsgsRaw, attributesStruct, encoder);
      checkMapsEqual(revealedMsgs, revealedMsgsFromVerifier);

      const statement2 = verifierStmt(
        sigParams,
        revealedMsgsFromVerifier,
        pk
      );
      const statementsVerifier = new Statements();
      statementsVerifier.add(statement2);

      // The verifier should independently construct this `ProofSpec`
      const proofSpecVerifier = new ProofSpec(statementsVerifier, new MetaStatements());
      expect(proofSpecVerifier.isValid()).toEqual(true);

      checkResult(proof.verify(proofSpecVerifier));

      i++;
    }
  });

  it('signing and proof of knowledge of 2 signatures', () => {
    // This test check that 2 signatures can be produced and verified and proof of knowledge of both signatures can be
    // done while revealing only some attributes (selective-disclosure) from each signature.
    // Nested attributes are separated by a "dot" (.)

    // 1st signer's setup
    const label1 = stringToBytes('Sig params label 1');
    // Message count shouldn't matter as `label1` is known
    const [params1, sk1, pk1] = getParamsAndKeys(100, label1);

    // 2nd signer's setup
    const label2 = stringToBytes('Sig params label 2');
    // Message count shouldn't matter as `label2` is known
    const [params2, sk2, pk2] = getParamsAndKeys(100, label2);

    const encoder = new Encoder(undefined, defaultEncoder);

    // Sign and verify all signatures
    const signed1 = signAndVerify(attributes1, encoder, label1, sk1, pk1);
    const signed2 = signAndVerify(attributes2, encoder, label2, sk2, pk2);

    // Reveal
    // - first name ("fname" attribute) from both sets of signed attributes
    // - attributes "BMI" and "country" from 1st signed attribute set
    // - attributes "location.country", "physical.BMI" and "score" from 2nd signed attribute set

    const revealedNames1 = new Set<string>();
    revealedNames1.add('fname');
    revealedNames1.add('BMI');
    revealedNames1.add('country');

    const revealedNames2 = new Set<string>();
    revealedNames2.add('fname');
    revealedNames2.add('location.country');
    revealedNames2.add('physical.BMI');
    revealedNames2.add('score');

    // Both prover and verifier can independently create this struct
    const sigParams1 = getAdaptedSignatureParamsForMessages(params1, attributes1Struct);
    const sigParams2 = getAdaptedSignatureParamsForMessages(params2, attributes2Struct);

    const [revealedMsgs1, unrevealedMsgs1, revealedMsgsRaw1] = getRevealedAndUnrevealed(
      attributes1,
      revealedNames1,
      encoder
    );
    expect(revealedMsgsRaw1).toEqual({ fname: 'John', BMI: 23.25, country: 'USA' });

    const statement1 = proverStmt(
      sigParams1,
      revealedMsgs1,
      pk1,
    );

    const [revealedMsgs2, unrevealedMsgs2, revealedMsgsRaw2] = getRevealedAndUnrevealed(
      attributes2,
      revealedNames2,
      encoder
    );
    expect(revealedMsgsRaw2).toEqual({
      fname: 'John',
      location: {
        country: 'USA'
      },
      physical: {
        BMI: 23.25
      },
      score: -13.5
    });

    const statement2 = proverStmt(
      sigParams2,
      revealedMsgs2,
      pk2,
    );

    const statementsProver = new Statements();
    statementsProver.add(statement1);
    statementsProver.add(statement2);

    // The prover should independently construct this `ProofSpec`
    const proofSpecProver = new ProofSpec(statementsProver, new MetaStatements());
    expect(proofSpecProver.isValid()).toEqual(true);

    const witness1 = buildWitness(signed1.signature, unrevealedMsgs1, false);
    const witness2 = buildWitness(signed2.signature, unrevealedMsgs2, false);
    const witnesses = new Witnesses();
    witnesses.add(witness1);
    witnesses.add(witness2);

    const proof = CompositeProof.generate(proofSpecProver, witnesses);

    // Verifier independently encodes revealed messages
    const revealedMsgs1FromVerifier = encodeRevealedMsgs(revealedMsgsRaw1, attributes1Struct, encoder);
    checkMapsEqual(revealedMsgs1, revealedMsgs1FromVerifier);
    const revealedMsgs2FromVerifier = encodeRevealedMsgs(revealedMsgsRaw2, attributes2Struct, encoder);
    checkMapsEqual(revealedMsgs2, revealedMsgs2FromVerifier);

    const statement3 = verifierStmt(
      sigParams1,
      revealedMsgs1FromVerifier,
      pk1
    );
    const statement4 = verifierStmt(
      sigParams2,
      revealedMsgs2FromVerifier,
      pk2
    );
    const statementsVerifier = new Statements();
    statementsVerifier.add(statement3);
    statementsVerifier.add(statement4);

    // The verifier should independently construct this `ProofSpec`
    const proofSpecVerifier = new ProofSpec(statementsVerifier, new MetaStatements());
    expect(proofSpecVerifier.isValid()).toEqual(true);

    checkResult(proof.verify(proofSpecVerifier));
  });

  it('signing and proof of knowledge of 3 signatures and attribute equality', () => {
    // This test check that a multiple signatures created by different signers can be verified and proof of knowledge of
    // signatures can be done selective-disclosure while also proving equality between some of the hidden attributes.

    // 1st signer's setup
    const label1 = stringToBytes('Sig params label 1');
    // Message count shouldn't matter as `label1` is known
    const [params1, sk1, pk1] = getParamsAndKeys(100, label1);

    // 2nd signer's setup
    const label2 = stringToBytes('Sig params label 2');
    // Message count shouldn't matter as `label2` is known
    const [params2, sk2, pk2] = getParamsAndKeys(100, label2);

    // 3rd signer's setup
    const label3 = stringToBytes('Sig params label 3');
    // Message count shouldn't matter as `label3` is known
    const [params3, sk3, pk3] = getParamsAndKeys(100, label3);

    const encoder = new Encoder(undefined, defaultEncoder);

    // Sign and verify all signatures
    const signed1 = signAndVerify(attributes1, encoder, label1, sk1, pk1);
    const signed2 = signAndVerify(attributes2, encoder, label2, sk2, pk2);
    const signed3 = signAndVerify(attributes3, encoder, label3, sk3, pk3);

    // Reveal
    // - first name ("fname" attribute) from all 3 sets of signed attributes
    // - attributes "BMI" and "country" from 1st signed attribute set
    // - attributes "location.country" and "physical.BMI" from 2nd signed attribute set
    // - attributes "lessSensitive.location.country", "lessSensitive.department.name", "lessSensitive.department.location.name" and "rank" from 3rd signed attribute set

    // Prove equality in zero knowledge of
    // - last name ("lname" attribute), Social security number ("SSN" attribute) and city in all 3 sets of signed attributes
    // - attributes "email", "score", "height" and "weight" in 1st and 2nd sets of signed attributes
    // - attributes "user-id" and "employee-id" in 2nd and 3rd set of attributes

    const revealedNames1 = new Set<string>();
    revealedNames1.add('fname');
    revealedNames1.add('BMI');
    revealedNames1.add('country');

    const revealedNames2 = new Set<string>();
    revealedNames2.add('fname');
    revealedNames2.add('location.country');
    revealedNames2.add('physical.BMI');

    const revealedNames3 = new Set<string>();
    revealedNames3.add('fname');
    revealedNames3.add('lessSensitive.location.country');
    revealedNames3.add('lessSensitive.department.name');
    revealedNames3.add('lessSensitive.department.location.name');
    revealedNames3.add('rank');

    // Both prover and verifier can independently create this struct
    const sigParams1 = getAdaptedSignatureParamsForMessages(params1, attributes1Struct);
    const sigParams2 = getAdaptedSignatureParamsForMessages(params2, attributes2Struct);
    const sigParams3 = getAdaptedSignatureParamsForMessages(params3, attributes3Struct);

    const [revealedMsgs1, unrevealedMsgs1, revealedMsgsRaw1] = getRevealedAndUnrevealed(
      attributes1,
      revealedNames1,
      encoder
    );
    expect(revealedMsgsRaw1).toEqual({ fname: 'John', BMI: 23.25, country: 'USA' });

    const statement1 = proverStmt(
      sigParams1,
      revealedMsgs1,
      pk1,
    );

    const [revealedMsgs2, unrevealedMsgs2, revealedMsgsRaw2] = getRevealedAndUnrevealed(
      attributes2,
      revealedNames2,
      encoder
    );
    expect(revealedMsgsRaw2).toEqual({
      fname: 'John',
      location: {
        country: 'USA'
      },
      physical: {
        BMI: 23.25
      }
    });

    const statement2 = proverStmt(
      sigParams2,
      revealedMsgs2,
      pk2,
    );

    const [revealedMsgs3, unrevealedMsgs3, revealedMsgsRaw3] = getRevealedAndUnrevealed(
      attributes3,
      revealedNames3,
      encoder
    );
    expect(revealedMsgsRaw3).toEqual({
      fname: 'John',
      lessSensitive: {
        location: {
          country: 'USA'
        },
        department: {
          name: 'Random',
          location: {
            name: 'Somewhere'
          }
        }
      },
      rank: 6
    });

    const statement3 = proverStmt(
      sigParams3,
      revealedMsgs3,
      pk3,
    );

    const statementsProver = new Statements();
    const sIdx1 = statementsProver.add(statement1);
    const sIdx2 = statementsProver.add(statement2);
    const sIdx3 = statementsProver.add(statement3);

    // Construct new `MetaStatement`s to enforce attribute equality

    // One approach is to get indices for attribute names and then construct a `WitnessEqualityMetaStatement` as follows
    const witnessEq1 = new WitnessEqualityMetaStatement();
    witnessEq1.addWitnessRef(sIdx1, getIndicesForMsgNames(['lname'], attributes1Struct)[0]);
    witnessEq1.addWitnessRef(sIdx2, getIndicesForMsgNames(['lname'], attributes2Struct)[0]);
    witnessEq1.addWitnessRef(sIdx3, getIndicesForMsgNames(['lname'], attributes3Struct)[0]);

    const witnessEq2 = new WitnessEqualityMetaStatement();
    witnessEq2.addWitnessRef(sIdx1, getIndicesForMsgNames(['city'], attributes1Struct)[0]);
    witnessEq2.addWitnessRef(sIdx2, getIndicesForMsgNames(['location.city'], attributes2Struct)[0]);
    witnessEq2.addWitnessRef(sIdx3, getIndicesForMsgNames(['lessSensitive.location.city'], attributes3Struct)[0]);

    // Another approach is to construct `WitnessEqualityMetaStatement` directly as follows
    const witnessEq3 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx1, [['SSN'], attributes1Struct]);
        m.set(sIdx2, [['sensitive.SSN'], attributes2Struct]);
        m.set(sIdx3, [['sensitive.SSN'], attributes3Struct]);
        return m;
      })()
    );

    const witnessEq4 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx1, [['email'], attributes1Struct]);
        m.set(sIdx2, [['sensitive.email'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq5 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx1, [['score'], attributes1Struct]);
        m.set(sIdx2, [['score'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq6 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx1, [['height'], attributes1Struct]);
        m.set(sIdx2, [['physical.height'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq7 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx1, [['weight'], attributes1Struct]);
        m.set(sIdx2, [['physical.weight'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq9 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx2, [['sensitive.user-id'], attributes2Struct]);
        m.set(sIdx3, [['sensitive.employee-id'], attributes3Struct]);
        return m;
      })()
    );

    // NOTE: Both of the above approaches are in-efficient where they repeatedly flatten the same objects. An efficient way
    // would be to flatten the objects just once and get indices for all names but the above approach is simpler to code with.

    const metaStmtsProver = new MetaStatements();
    metaStmtsProver.addWitnessEquality(witnessEq1);
    metaStmtsProver.addWitnessEquality(witnessEq2);
    metaStmtsProver.addWitnessEquality(witnessEq3);
    metaStmtsProver.addWitnessEquality(witnessEq4);
    metaStmtsProver.addWitnessEquality(witnessEq5);
    metaStmtsProver.addWitnessEquality(witnessEq6);
    metaStmtsProver.addWitnessEquality(witnessEq7);
    metaStmtsProver.addWitnessEquality(witnessEq9);

    // The prover should independently construct this `ProofSpec`
    const proofSpecProver = new ProofSpec(statementsProver, metaStmtsProver);
    expect(proofSpecProver.isValid()).toEqual(true);

    const witness1 = buildWitness(signed1.signature, unrevealedMsgs1, false);
    const witness2 = buildWitness(signed2.signature, unrevealedMsgs2, false);
    const witness3 = buildWitness(signed3.signature, unrevealedMsgs3, false);
    const witnesses = new Witnesses();
    witnesses.add(witness1);
    witnesses.add(witness2);
    witnesses.add(witness3);

    const proof = CompositeProof.generate(proofSpecProver, witnesses);

    // Verifier independently encodes revealed messages
    const revealedMsgs1FromVerifier = encodeRevealedMsgs(revealedMsgsRaw1, attributes1Struct, encoder);
    checkMapsEqual(revealedMsgs1, revealedMsgs1FromVerifier);
    const revealedMsgs2FromVerifier = encodeRevealedMsgs(revealedMsgsRaw2, attributes2Struct, encoder);
    checkMapsEqual(revealedMsgs2, revealedMsgs2FromVerifier);
    const revealedMsgs3FromVerifier = encodeRevealedMsgs(revealedMsgsRaw3, attributes3Struct, encoder);
    checkMapsEqual(revealedMsgs3, revealedMsgs3FromVerifier);

    const statement4 = verifierStmt(
      sigParams1,
      revealedMsgs1FromVerifier,
      pk1
    );
    const statement5 = verifierStmt(
      sigParams2,
      revealedMsgs2FromVerifier,
      pk2
    );
    const statement6 = verifierStmt(
      sigParams3,
      revealedMsgs3FromVerifier,
      pk3
    );
    const statementsVerifier = new Statements();
    const sIdx4 = statementsVerifier.add(statement4);
    const sIdx5 = statementsVerifier.add(statement5);
    const sIdx6 = statementsVerifier.add(statement6);

    // Similarly for verifier
    const witnessEq10 = new WitnessEqualityMetaStatement();
    witnessEq10.addWitnessRef(sIdx4, getIndicesForMsgNames(['lname'], attributes1Struct)[0]);
    witnessEq10.addWitnessRef(sIdx5, getIndicesForMsgNames(['lname'], attributes2Struct)[0]);
    witnessEq10.addWitnessRef(sIdx6, getIndicesForMsgNames(['lname'], attributes3Struct)[0]);

    const witnessEq11 = new WitnessEqualityMetaStatement();
    witnessEq11.addWitnessRef(sIdx4, getIndicesForMsgNames(['city'], attributes1Struct)[0]);
    witnessEq11.addWitnessRef(sIdx5, getIndicesForMsgNames(['location.city'], attributes2Struct)[0]);
    witnessEq11.addWitnessRef(sIdx6, getIndicesForMsgNames(['lessSensitive.location.city'], attributes3Struct)[0]);

    const witnessEq12 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx4, [['SSN'], attributes1Struct]);
        m.set(sIdx5, [['sensitive.SSN'], attributes2Struct]);
        m.set(sIdx6, [['sensitive.SSN'], attributes3Struct]);
        return m;
      })()
    );

    const witnessEq13 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx4, [['email'], attributes1Struct]);
        m.set(sIdx5, [['sensitive.email'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq14 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx4, [['score'], attributes1Struct]);
        m.set(sIdx5, [['score'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq15 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx4, [['height'], attributes1Struct]);
        m.set(sIdx5, [['physical.height'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq16 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx4, [['weight'], attributes1Struct]);
        m.set(sIdx5, [['physical.weight'], attributes2Struct]);
        return m;
      })()
    );

    const witnessEq18 = createWitnessEqualityMetaStatement(
      (() => {
        const m = new Map<number, [msgNames: string[], msgStructure: object]>();
        m.set(sIdx5, [['sensitive.user-id'], attributes2Struct]);
        m.set(sIdx6, [['sensitive.employee-id'], attributes3Struct]);
        return m;
      })()
    );

    const metaStmtsVerifier = new MetaStatements();
    metaStmtsVerifier.addWitnessEquality(witnessEq10);
    metaStmtsVerifier.addWitnessEquality(witnessEq11);
    metaStmtsVerifier.addWitnessEquality(witnessEq12);
    metaStmtsVerifier.addWitnessEquality(witnessEq13);
    metaStmtsVerifier.addWitnessEquality(witnessEq14);
    metaStmtsVerifier.addWitnessEquality(witnessEq15);
    metaStmtsVerifier.addWitnessEquality(witnessEq16);
    metaStmtsVerifier.addWitnessEquality(witnessEq18);

    // The verifier should independently construct this `ProofSpec`
    const proofSpecVerifier = new ProofSpec(statementsVerifier, metaStmtsVerifier);
    expect(proofSpecVerifier.isValid()).toEqual(true);

    checkResult(proof.verify(proofSpecVerifier));
  });

  it('signing and proof of knowledge of a signature and attribute inequality with a public value', () => {
    const commKey = new PederCommKey(stringToBytes('test'));
    const label1 = stringToBytes('Sig params label 1');
    // Message count shouldn't matter as `label1` is known
    const [params1, sk1, pk1] = getParamsAndKeys(100, label1);

    const encoder = new Encoder(undefined, defaultEncoder);

    // Sign and verify all signatures
    const signed1 = signAndVerify(attributes1, encoder, label1, sk1, pk1);

    const revealedNames1 = new Set<string>();
    revealedNames1.add('fname');

    // Both prover and verifier can independently create this struct
    const sigParams1 = getAdaptedSignatureParamsForMessages(params1, attributes1Struct);
    const [revealedMsgs1, unrevealedMsgs1, revealedMsgsRaw1] = getRevealedAndUnrevealed(
      attributes1,
      revealedNames1,
      encoder
    );

    const wrongEmail1 = 'alice@example.com';
    const wrongEmail2 = 'bob@example.com';

    expect(attributes1.email).not.toEqual(wrongEmail1);
    expect(attributes1.email).not.toEqual(wrongEmail2);
    const wrongEmail1Encoded = encoder.encodeMessage('email', wrongEmail1);
    const wrongEmail2Encoded = encoder.encodeMessage('email', wrongEmail2);

    const statement1 = proverStmt(
      sigParams1,
      revealedMsgs1,
      pk1,
    );

    const statement2 = Statement.publicInequalityG1FromCompressedParams(wrongEmail1Encoded, commKey);
    const statement3 = Statement.publicInequalityG1FromCompressedParams(wrongEmail2Encoded, commKey);

    const statementsProver = new Statements();
    const sIdx1 = statementsProver.add(statement1);
    const sIdx2 = statementsProver.add(statement2);
    const sIdx3 = statementsProver.add(statement3);
    const witnessEq1 = new WitnessEqualityMetaStatement();
    witnessEq1.addWitnessRef(sIdx1, getIndicesForMsgNames(['email'], attributes1Struct)[0]);
    witnessEq1.addWitnessRef(sIdx2, 0);
    witnessEq1.addWitnessRef(sIdx3, 0);

    const metaStmtsProver = new MetaStatements();
    metaStmtsProver.addWitnessEquality(witnessEq1);

    const proofSpec = new ProofSpec(statementsProver, metaStmtsProver);
    expect(proofSpec.isValid()).toEqual(true);

    const witness1 = buildWitness(signed1.signature, unrevealedMsgs1, false);
    const witness2 = Witness.publicInequality(encoder.encodeMessage('email', attributes1['email']));
    const witness3 = Witness.publicInequality(encoder.encodeMessage('email', attributes1['email']));

    const witnesses = new Witnesses();
    witnesses.add(witness1);
    witnesses.add(witness2);
    witnesses.add(witness3);

    const proof = CompositeProof.generate(proofSpec, witnesses);

    const statement4 = verifierStmt(
      sigParams1,
      revealedMsgs1,
      pk1
    );
    const statementsVerifier = new Statements(statement4);
    statementsVerifier.add(statement2);
    statementsVerifier.add(statement3);
    const proofSpecVerifier = new ProofSpec(statementsVerifier, metaStmtsProver);
    expect(proofSpecVerifier.isValid()).toEqual(true);
    checkResult(proof.verify(proofSpecVerifier));
  });
});