|
|
@@ -0,0 +1,59 @@
|
|
|
+q = 0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000001
|
|
|
+K = GF(q)
|
|
|
+a = K(0x00)
|
|
|
+b = K(0x05)
|
|
|
+E = EllipticCurve(K, (a, b))
|
|
|
+G = E(0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000000, 0x02)
|
|
|
+
|
|
|
+p = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
|
|
|
+assert E.order() == p
|
|
|
+Scalar = GF(p)
|
|
|
+
|
|
|
+a1, a2, a3, a4, a5, a6, a7, a8, a9, a10 = (
|
|
|
+ Scalar(110), Scalar(56), Scalar(89), Scalar(6543), Scalar(2),
|
|
|
+ Scalar(110), Scalar(44), Scalar(78), Scalar(77), Scalar(4))
|
|
|
+
|
|
|
+G1, G2, G3, G4, G5, G6, G7, G8, G9, G10 = (
|
|
|
+ E.random_element(), E.random_element(), E.random_element(),
|
|
|
+ E.random_element(), E.random_element(), E.random_element(),
|
|
|
+ E.random_element(), E.random_element(), E.random_element(),
|
|
|
+ E.random_element())
|
|
|
+
|
|
|
+A = (int(a1) * G1 + int(a2) * G2 + int(a3) * G3 + int(a4) * G4
|
|
|
+ + int(a5) * G5 + int(a6) * G6 + int(a7) * G7 + int(a8) * G8
|
|
|
+ + int(a9) * G9 + int(a10) * G10)
|
|
|
+
|
|
|
+# This function is homomorphic, so:
|
|
|
+#
|
|
|
+# H(a_lo_1, a_hi_1) + H(a_lo_2, a_hi_2) = H(a_lo_1 + a_lo_2, a_hi_1 + a_hi_2)
|
|
|
+#
|
|
|
+# This function is actually the same as the dot product:
|
|
|
+#
|
|
|
+# H(a_lo, a_hi) = <a_lo, G_lo> + <a_hi, G_hi>
|
|
|
+#
|
|
|
+def hash(a_lo, a_hi):
|
|
|
+ return (int(a_lo[0]) * G1 + int(a_lo[1]) * G2 + int(a_lo[2]) * G3
|
|
|
+ + int(a_lo[3]) * G4 + int(a_lo[4]) * G5 + int(a_hi[0]) * G6
|
|
|
+ + int(a_hi[1]) * G7 + int(a_hi[2]) * G8 + int(a_hi[3]) * G9
|
|
|
+ + int(a_hi[4]) * G10)
|
|
|
+
|
|
|
+x = Scalar.random_element()
|
|
|
+
|
|
|
+zeros = [Scalar(0)] * 5
|
|
|
+a_lo = vector([a1, a2, a3, a4, a5])
|
|
|
+a_hi = vector([a6, a7, a8, a9, a10])
|
|
|
+
|
|
|
+L = hash(zeros, a_lo)
|
|
|
+R = hash(a_hi, zeros)
|
|
|
+P = hash(a_lo, a_hi)
|
|
|
+
|
|
|
+a_prime = x * a_lo + x^-1 * a_hi
|
|
|
+assert len(a_prime) == 5
|
|
|
+
|
|
|
+# See section 3 of the bulletproofs paper
|
|
|
+P_prime = hash(x^-1 * a_prime, x * a_prime)
|
|
|
+assert P_prime == int(x^2) * L + P + int(x^-2) * R
|
|
|
+
|
|
|
+# Proof is 5 + 2 elements instead of 10 commitments to each value a_i
|
|
|
+proof = (L, R, a)
|
|
|
+
|
narodnik