bulletproofs-0.2.0

Bulletproofs.RangeProof.Internal

Synopsis

Documentation

Constructors

 RangeProof FieldstBlinding :: FqBlinding factor of the T1 and T2 commitments, combined into the form required to make the committed version of the x-polynomial add upmu :: FqBlinding factor required for the Verifier to verify commitments A, St :: FqDot product of vectors l and r that prove knowledge of the value in range t = t(x) = l(x) · r(x)aCommit :: PointCommitment to aL and aR, where aL and aR are vectors of bits such that aL · 2^n = v and aR = aL − 1^n . A = α · H + aL · G + aR · HsCommit :: PointCommitment to new vectors sL, sR, created at random by the Provert1Commit :: PointPedersen commitment to coefficient t1t2Commit :: PointPedersen commitment to coefficient t2productProof :: InnerProductProofInner product argument to prove that a commitment P has vectors l, r ∈ Z^n for which P = l · G + r · H + ( l, r ) · U
Instances
 Source # Instance detailsDefined in Bulletproofs.RangeProof.Internal Methods Source # Instance detailsDefined in Bulletproofs.RangeProof.Internal MethodsshowList :: [RangeProof] -> ShowS #

Constructors

 UpperBoundTooLarge Integer The upper bound of the range is too large ValueNotInRange Integer Value is not within the range required NNotPowerOf2 Integer Dimension n is required to be a power of 2
Instances
 Source # Instance detailsDefined in Bulletproofs.RangeProof.Internal MethodsshowList :: [RangeProofError] -> ShowS #

data LRPolys Source #

Constructors

 LRPolys Fieldsl0 :: [Fq] l1 :: [Fq] r0 :: [Fq] r1 :: [Fq]

data TPoly Source #

Constructors

 TPoly Fieldst0 :: Fq t1 :: Fq t2 :: Fq

delta :: Integer -> Fq -> Fq -> Fq Source #

(z − z^2) * y^n − z^3 * 2^n

Check that a value is in aCommit sCommitpecific range

reversedEncodeBit :: Integer -> Fq -> [Fq] Source #

Bits of v reversed. v = 2^n = a_0 * 2^0 + ... + a_n-1 * 2^(n-1)

complementaryVector :: Num a => [a] -> [a] Source #

In order to prove that v is in range, each element of aL is either 0 or 1. We construct a “complementary” vector aR = aL − 1^n and require that aL ◦ aR = 0 hold.

commitBitVectors :: MonadRandom m => Fq -> Fq -> [Fq] -> [Fq] -> [Fq] -> [Fq] -> m (Point, Point) Source #

We need to blind the vectors aL, aR to make the proof zero knowledge. The Prover creates randomly vectors sL and sR. On creating these, the Prover can send commitments to these vectors; these are properly blinded vector Pedersen commitments:

computeLRCommitment :: Integer -> Point -> Point -> Fq -> Fq -> Fq -> Fq -> Fq -> Fq -> [Point] -> Point Source #

Compute commitment of linear vector polynomials l and r P = A + xS − zG + (z*y^n + z^2 * 2^n) * hs'

obfuscateEncodedBits :: Integer -> [Fq] -> [Fq] -> Fq -> Fq -> Fq Source #

Obfuscate encoded bits with challenges y and z. z^2 * 2^n + z * − 1^n − aR, y^n + aR · y^n = (z^2) * v The property holds because − 1^n − aR, y^n = 0 and · aR, y^n = 0