úÎ!‡m€;{      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvw x y z None- bulletproofsOrder of the curve bulletproofsGenerator of the curve bulletproofsH = aG where a is not known bulletproofsGenerate vector of generators in a deterministic way from the curve generator g by applying H(encode(g) || i) where H is a secure hash function bulletproofsGenerate vector of generators in a deterministic way from the curve generator h by applying H(encode(h) || i) where H is a secure hash function bulletproofs}A random oracle. In the Fiat-Shamir heuristic, its input is specifically the transcript of the interaction up to that point.  bulletproofsCCharacteristic of the underlying finite field of the elliptic curve  bulletproofs’Iterative algorithm to generate H. The important thing about the H value is that nobody gets to know its discrete logarithm "k" such that H = kG   NoneKÎ  bulletproofs Prime field with characteristic _q  bulletproofsUse new instead of this constructor bulletproofsTurn an integer into an Fq( number, should be used instead of the Fq constructor. bulletproofsMultiplicative inverse bulletproofsAdditive identity bulletproofsMultiplicative identity bulletproofs=Euclidean algorithm to compute inverse in an integral domain a    None)º ) bulletproofsIndependent generator Gs " G^n* bulletproofsIndependent generator Hs " G^n+ bulletproofsiInternally fixed group element H " G for which there is no known discrete-log relation among Gs, Hs, bG. bulletproofseVector of values l that the prover uses to compute lCommits in the recursive inner product algorithm/ bulletproofseVector of values r that the prover uses to compute rCommits in the recursive inner product algorithm2 bulletproofs}Vector of commitments of the elements in the original vector l whose size is the logarithm of base 2 of the size of vector l3 bulletproofs}Vector of commitments of the elements in the original vector r whose size is the logarithm of base 2 of the size of vector r4 bulletproofskRemaining element of vector l at the end of the recursive algorithm that generates the inner-product proof5 bulletproofskRemaining element of vector r at the end of the recursive algorithm that generates the inner-product proof'(+*),-/.013245013245,-/.'(+*)None1~< bulletproofs2Return a vector containing the first n powers of a= bulletproofs,Inner product between two vector polynomials> bulletproofs<Hadamard product or entry wise multiplication of two vectors? bulletproofs Add two points of the same curve@ bulletproofs&Substract two points of the same curveA bulletproofs2Multiply a scalar and a point in an elliptic curveB bulletproofsLCreate a Pedersen commitment to a value given a value and a blinding factor<=>?@ABCDEFGHIJ<=>?@ABCDEFGHIJNoneTéW bulletproofs)The upper bound of the range is too largeX bulletproofs&Value is not within the range requiredY bulletproofs*Dimension n is required to be a power of 2\ bulletproofs‡Blinding factor of the T1 and T2 commitments, combined into the form required to make the committed version of the x-polynomial add up] bulletproofsDBlinding factor required for the Verifier to verify commitments A, S^ bulletproofsaDot product of vectors l and r that prove knowledge of the value in range t = t(x) = l(x) · r(x)_ bulletproofs…Commitment to aL and aR, where aL and aR are vectors of bits such that aL · 2^n = v and aR = aL " 1^n . A = ± · H + aL · G + aR · H` bulletproofsACommitment to new vectors sL, sR, created at random by the Provera bulletproofs%Pedersen commitment to coefficient t1b bulletproofs%Pedersen commitment to coefficient t2c bulletproofswInner product argument to prove that a commitment P has vectors l, r " Z^n for which P = l · G + r · H + ( l, r ) · Ud bulletproofsTEncode the value v into a bit representation. Let aL be a vector of bits such that  aL,2^nJ = v (put more simply, the components of a L are the binary digits of v).e bulletproofsBits of v reversed. v =  a,2^n$ = a_0 * 2^0 + ... + a_n-1 * 2^(n-1)f bulletproofs£In order to prove that v is in range, each element of aL is either 0 or 1. We construct a complementary  vector aR = aL " 1^n and require that aL %æ aR = 0 hold.g bulletproofs_Add non-relevant zeros to a vector to match the size of the other vectors used in the protocolh bulletproofs7Obfuscate encoded bits with challenges y and z. z^2 *  aL,2^n + z *  aL" 1^n " aR, y^n +  aL,aR · y^n) = (z^2) * v The property holds because  aL" 1^n " aR, y^n = 0 and  aL · aR, y^n = 0j bulletproofsôWe need to blind the vectors aL, aR to make the proof zero knowledge. The Prover creates randomly vectors sL and sR. On creating these, the Prover can send commitments to these vectors; these are properly blinded vector Pedersen commitments:l bulletproofs (z " z^2) *  1^n,y^n " z^3 * 1^n,2^nm bulletproofs5Check that a value is in aCommit sCommitpecific rangen bulletproofsdCompute commitment of linear vector polynomials l and r P = A + xS " zG + (z*y^n + z^2 * 2^n) * hs'$KLOMNPQTRUSVYXWZ[c\ba`_^]defghijklmn$Z[c\ba`_^]VYXWPQTRUSKLOMNdefghijklmnNone"#$^Zªr bulletproofsTOptimized non-interactive verifier using multi-exponentiation and batch verificationr bulletproofsRange upper bound bulletproofsGenerators Gs, Hs, h bulletproofs Commitment P bulletproofs>Proof that a secret committed value lies in a certain intervalrrNone$^`Ys bulletproofsdGenerate proof that a witness l, r satisfies the inner product relation on public input (Gs, Hs, h)s bulletproofsGenerators Gs, Hs, h bulletproofscCommitment P = A + xS " zG + (z*y^n + z^2 * 2^n) * hs' of vectors l and r whose inner product is t bulletproofs=Vectors l and r that hide bit vectors aL and aR, respectivelyss None`Ÿ'()*+,-./015423rssr015423'()*+,-./None"#$%^prt bulletproofsCVerify that a commitment was computed from a value in a given rangeu bulletproofsªVerify the constant term of the polynomial t t = t(x) = t0 + t1*x + t2*x^2 This is what binds the proof to the actual original Pedersen commitment V to the actual valuev bulletproofsEVerify the inner product argument for the vectors l and r that form tt bulletproofsRange upper bound bulletproofsCommitment of an in-range value bulletproofs>Proof that a secret committed value lies in a certain intervalu bulletproofsDimension n of the vectors bulletproofsCommitment of an in-range value bulletproofs>Proof that a secret committed value lies in a certain interval bulletproofs Challenge x bulletproofs Challenge y bulletproofs Challenge zv bulletproofsDimension n of the vectors bulletproofs>Proof that a secret committed value lies in a certain interval bulletproofs Challenge x bulletproofs Challenge y bulletproofs Challenge ztuvtuv None"#^~êw bulletproofs+Prove that a value lies in a specific rangex bulletproofs&Generate range proof from valid inputsy bulletproofsÿ–Compute l and r polynomials to prove knowledge of aL, aR without revealing them. We achieve it by transferring the vectors l, r. The two terms of the dot product above are set as the constant term, while sL, sR are the coefficient of x^1 , in the following two linear polynomials, which are combined into a quadratic in x: l(x) = (a L " z1 n ) + s L x r(x) = y^n %æ (aR + z * 1^n + sR * x) + z^2 * 2^nz bulletproofsSCompute polynomial t from polynomial r t(x) = l(x) · r(x) = t0 + t1 * x + t2 * x^2w bulletproofs)Upper bound of the range we want to prove bulletproofsValue we want to prove in range bulletproofsBlinding factorx bulletproofs)Upper bound of the range we want to prove bulletproofsValue we want to prove in range bulletproofsBlinding factorwxyzwxyz NoneHVWXYZ[]^_`ab\ctwxZ[]^_`ab\cVWXYwxt Safe€{|}~€‚ƒ  !"#$%&'()*+,-./012334567789::;<=>?@ABCDEFGHIJKLMNOPQRSTTUVWXXYZ[\]^_`aabcdefghijklmnopqrstuvwxyxz{ y | } ~  € ‚ ƒ „ … †‡)bulletproofs-0.1.0-F4gaWLVjXEhLh2qw6cGxkKBulletproofs.CurveBulletproofs.Fq'Bulletproofs.InnerProductProof.InternalBulletproofs.Utils Bulletproofs.RangeProof.Internal'Bulletproofs.InnerProductProof.Verifier%Bulletproofs.InnerProductProof.Prover Bulletproofs.RangeProof.VerifierBulletproofs.RangeProof.ProverBulletproofs.InnerProductProofBulletproofs.RangeProofPaths_bulletproofs curveNamecurveqghgshsoraclesha256 pointToBSp generateHFqnewnormfqAddfqMulfqNegfqDivfqInvfqZerofqOnefqSquarefqCubeinv asInteger euclideaninv'randomfqAddVfqSubVfqMulV$fFractionalFq$fNumFq$fShowFq$fEqFq$fBitsFq$fOrdFqInnerProductBasebGsbHsbHInnerProductWitnesslsrsInnerProductProoflCommitsrCommitslr$fShowInnerProductProof$fEqInnerProductProof$fShowInnerProductWitness$fEqInnerProductWitness$fShowInnerProductBase$fEqInnerProductBase powerVectordotp hadamardpaddPsubPmulPcommit isLogBase2logBase2 logBase2MshamirYshamirZshamirXshamirX'shamirUTPolyt0t1t2LRPolysl0l1r0r1RangeProofErrorUpperBoundTooLargeValueNotInRange NNotPowerOf2 RangeProof tBlindingmutaCommitsCommitt1Committ2Commit productProof encodeBitreversedEncodeBitcomplementaryVector fillWithZerosobfuscateEncodedBitsobfuscateEncodedBitsSinglecommitBitVectorschooseBlindingVectorsdelta checkRangecomputeLRCommitment$fShowRangeProof$fEqRangeProof$fShowRangeProofError verifyProof generateProof verifyTPolyverifyLRCommitmentgenerateProofUnsafecomputeLRPolys computeTPolyversion getBinDir getLibDir getDynLibDir getDataDir getLibexecDir getSysconfDirgetDataFileName