!n~j      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefgh i NoneP bulletproofsOrder of the curve bulletproofsGenerator of the curve bulletproofsH = aG where a is not known bulletproofsGenerate vector of generators in a deterministic way from the curve generator g by applying H(encode(g) || i) where H is a secure hash function bulletproofsGenerate vector of generators in a deterministic way from the curve generator h by applying H(encode(h) || i) where H is a secure hash function bulletproofs}A random oracle. In the Fiat-Shamir heuristic, its input is specifically the transcript of the interaction up to that point.j bulletproofsCCharacteristic of the underlying finite field of the elliptic curvek bulletproofsIterative algorithm to generate H. The important thing about the H value is that nobody gets to know its discrete logarithm "k" such that H = kGNoneK bulletproofs Prime field with characteristic _q  bulletproofsUse new instead of this constructor  bulletproofsTurn an integer into an Fq( number, should be used instead of the Fq constructor.  bulletproofsMultiplicative inverse  bulletproofsAdditive identity  bulletproofsMultiplicative identity bulletproofs=Euclidean algorithm to compute inverse in an integral domain a     None(}  bulletproofsIndependent generator Gs " G^n bulletproofsIndependent generator Hs " G^n bulletproofsiInternally fixed group element H " G for which there is no known discrete-log relation among Gs, Hs, bG" bulletproofseVector of values l that the prover uses to compute lCommits in the recursive inner product algorithm# bulletproofseVector of values r that the prover uses to compute rCommits in the recursive inner product algorithm& bulletproofs}Vector of commitments of the elements in the original vector l whose size is the logarithm of base 2 of the size of vector l' bulletproofs}Vector of commitments of the elements in the original vector r whose size is the logarithm of base 2 of the size of vector r( bulletproofskRemaining element of vector l at the end of the recursive algorithm that generates the inner-product proof) bulletproofskRemaining element of vector r at the end of the recursive algorithm that generates the inner-product proof !"#$%)(&'$%)(&' !"#None0A0 bulletproofs2Return a vector containing the first n powers of a1 bulletproofs,Inner product between two vector polynomials2 bulletproofs<Hadamard product or entry wise multiplication of two vectors3 bulletproofs Add two points of the same curve4 bulletproofs&Substract two points of the same curve5 bulletproofs2Multiply a scalar and a point in an elliptic curve6 bulletproofsLCreate a Pedersen commitment to a value given a value and a blinding factor0123456789:;<=1345=;<9:62078NoneSJ bulletproofs)The upper bound of the range is too largeK bulletproofs&Value is not within the range requiredL bulletproofs*Dimension n is required to be a power of 2O bulletproofsBlinding factor of the T1 and T2 commitments, combined into the form required to make the committed version of the x-polynomial add upP bulletproofsDBlinding factor required for the Verifier to verify commitments A, SQ bulletproofsaDot product of vectors l and r that prove knowledge of the value in range t = t(x) = l(x) r(x)R bulletproofsCommitment to aL and aR, where aL and aR are vectors of bits such that aL 2^n = v and aR = aL " 1^n . A =  H + aL G + aR HS bulletproofsACommitment to new vectors sL, sR, created at random by the ProverT bulletproofs%Pedersen commitment to coefficient t1U bulletproofs%Pedersen commitment to coefficient t2V bulletproofswInner product argument to prove that a commitment P has vectors l, r " Z^n for which P = l G + r H + ( l, r ) Ul bulletproofsTEncode the value v into a bit representation. Let aL be a vector of bits such that  aL,2^nJ = v (put more simply, the components of a L are the binary digits of v).W bulletproofsBits of v reversed. v =  a,2^n$ = a_0 * 2^0 + ... + a_n-1 * 2^(n-1)X bulletproofsIn order to prove that v is in range, each element of aL is either 0 or 1. We construct a complementary  vector aR = aL " 1^n and require that aL % aR = 0 hold.m bulletproofs_Add non-relevant zeros to a vector to match the size of the other vectors used in the protocolY bulletproofs7Obfuscate encoded bits with challenges y and z. z^2 *  aL,2^n + z *  aL" 1^n " aR, y^n +  aL,aR y^n) = (z^2) * v The property holds because  aL" 1^n " aR, y^n = 0 and  aL aR, y^n = 0[ bulletproofsWe need to blind the vectors aL, aR to make the proof zero knowledge. The Prover creates randomly vectors sL and sR. On creating these, the Prover can send commitments to these vectors; these are properly blinded vector Pedersen commitments:] bulletproofs (z " z^2) *  1^n,y^n " z^3 * 1^n,2^n^ bulletproofs5Check that a value is in aCommit sCommitpecific range_ bulletproofsdCompute commitment of linear vector polynomials l and r P = A + xS " zG + (z*y^n + z^2 * 2^n) * hs'">?A@BCDFHEGIJKLMNPQRSTUOVWXYZ[\]^_"MNPQRSTUOVIJKLCDFHEG>?A@B]^WX\[_YZNone"#$^YUc bulletproofsTOptimized non-interactive verifier using multi-exponentiation and batch verificationc bulletproofsRange upper bound bulletproofsGenerators Gs, Hs, h bulletproofs Commitment P bulletproofs>Proof that a secret committed value lies in a certain intervalccNone$^_d bulletproofsdGenerate proof that a witness l, r satisfies the inner product relation on public input (Gs, Hs, h)d bulletproofsGenerators Gs, Hs, h bulletproofscCommitment P = A + xS " zG + (z*y^n + z^2 * 2^n) * hs' of vectors l and r whose inner product is t bulletproofs=Vectors l and r that hide bit vectors aL and aR, respectivelydd None_J !"#$%)(&'cddc$%)(&' !"#None"#$%^oe bulletproofsCVerify that a commitment was computed from a value in a given rangef bulletproofsVerify the constant term of the polynomial t t = t(x) = t0 + t1*x + t2*x^2 This is what binds the proof to the actual original Pedersen commitment V to the actual valueg bulletproofsEVerify the inner product argument for the vectors l and r that form te bulletproofsRange upper bound bulletproofsCommitment of an in-range value bulletproofs>Proof that a secret committed value lies in a certain intervalf bulletproofsDimension n of the vectors bulletproofsCommitment of an in-range value bulletproofs>Proof that a secret committed value lies in a certain interval bulletproofs Challenge x bulletproofs Challenge y bulletproofs Challenge zg bulletproofsDimension n of the vectors bulletproofs>Proof that a secret committed value lies in a certain interval bulletproofs Challenge x bulletproofs Challenge y bulletproofs Challenge zefgefg None"#^}h bulletproofs+Prove that a value lies in a specific rangei bulletproofs&Generate range proof from valid inputsn bulletproofsCompute l and r polynomials to prove knowledge of aL, aR without revealing them. We achieve it by transferring the vectors l, r. The two terms of the dot product above are set as the constant term, while sL, sR are the coefficient of x^1 , in the following two linear polynomials, which are combined into a quadratic in x: l(x) = (a L " z1 n ) + s L x r(x) = y^n % (aR + z * 1^n + sR * x) + z^2 * 2^no bulletproofsSCompute polynomial t from polynomial r t(x) = l(x) r(x) = t0 + t1 * x + t2 * x^2h bulletproofs)Upper bound of the range we want to prove bulletproofsValue we want to prove in range bulletproofsBlinding factori bulletproofs)Upper bound of the range we want to prove bulletproofsValue we want to prove in range bulletproofsBlinding factorhihi None}IJKLMNPQRSTUOVehiMNPQRSTUOVIJKLhie Safe~pqrstuvwx  !"#$%&''()*++,-../0123456789:;<=>?@ABCDEFGGHIJKKLMNOPQRSTTUVWXYZ[\]^_`abcdefghijikl j mnopq r s t u v w x y z {|)bulletproofs-0.2.0-FseiMgTKdYa8f8pn7ow465Bulletproofs.CurveBulletproofs.Fq'Bulletproofs.InnerProductProof.InternalBulletproofs.Utils Bulletproofs.RangeProof.Internal'Bulletproofs.InnerProductProof.Verifier%Bulletproofs.InnerProductProof.Prover Bulletproofs.RangeProof.VerifierBulletproofs.RangeProof.ProverBulletproofs.InnerProductProofBulletproofs.RangeProofPaths_bulletproofscurveqghgshsoracle pointToBSFqnewfqInvfqZerofqOnefqSquarefqCubeinv euclideanrandomfqAddVfqSubV$fFractionalFq$fNumFq$fShowFq$fEqFq$fBitsFq$fOrdFqInnerProductBasebGsbHsbHInnerProductWitnesslsrsInnerProductProoflCommitsrCommitslr$fShowInnerProductProof$fEqInnerProductProof$fShowInnerProductWitness$fEqInnerProductWitness$fShowInnerProductBase$fEqInnerProductBase powerVectordotp hadamardpaddPsubPmulPcommitlogBase2 logBase2MshamirYshamirZshamirXshamirX'shamirUTPolyt0t1t2LRPolysl0l1r0r1RangeProofErrorUpperBoundTooLargeValueNotInRange NNotPowerOf2 RangeProof tBlindingmutaCommitsCommitt1Committ2Commit productProofreversedEncodeBitcomplementaryVectorobfuscateEncodedBitsobfuscateEncodedBitsSinglecommitBitVectorschooseBlindingVectorsdelta checkRangecomputeLRCommitment$fShowRangeProof$fEqRangeProof$fShowRangeProofError verifyProof generateProof verifyTPolyverifyLRCommitmentgenerateProofUnsafep generateH encodeBit fillWithZeroscomputeLRPolys computeTPolyversion getBinDir getLibDir getDynLibDir getDataDir getLibexecDir getSysconfDirgetDataFileName