| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071 |
- q = 0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000001
- K = GF(q)
- a = K(0x00)
- b = K(0x05)
- E = EllipticCurve(K, (a, b))
- G = E(0x40000000000000000000000000000000224698fc0994a8dd8c46eb2100000000, 0x02)
- p = 0x40000000000000000000000000000000224698fc094cf91b992d30ed00000001
- assert E.order() == p
- Scalar = GF(p)
- a1, a2, a3, a4, a5, a6, a7, a8, a9, a10 = (
- Scalar(110), Scalar(56), Scalar(89), Scalar(6543), Scalar(2),
- Scalar(110), Scalar(44), Scalar(78), Scalar(77), Scalar(4))
- G1, G2, G3, G4, G5, G6, G7, G8, G9, G10 = (
- E.random_element(), E.random_element(), E.random_element(),
- E.random_element(), E.random_element(), E.random_element(),
- E.random_element(), E.random_element(), E.random_element(),
- E.random_element())
- A = (int(a1) * G1 + int(a2) * G2 + int(a3) * G3 + int(a4) * G4
- + int(a5) * G5 + int(a6) * G6 + int(a7) * G7 + int(a8) * G8
- + int(a9) * G9 + int(a10) * G10)
- # This function is homomorphic, so:
- #
- # H(a_lo_1, a_hi_1) + H(a_lo_2, a_hi_2) = H(a_lo_1 + a_lo_2, a_hi_1 + a_hi_2)
- #
- # This function is actually the same as the dot product:
- #
- # H(a_lo, a_hi) = <a_lo, G_lo> + <a_hi, G_hi>
- #
- def hash(a_lo, a_hi):
- return (int(a_lo[0]) * G1 + int(a_lo[1]) * G2 + int(a_lo[2]) * G3
- + int(a_lo[3]) * G4 + int(a_lo[4]) * G5 + int(a_hi[0]) * G6
- + int(a_hi[1]) * G7 + int(a_hi[2]) * G8 + int(a_hi[3]) * G9
- + int(a_hi[4]) * G10)
- x = Scalar.random_element()
- zeros = [Scalar(0)] * 5
- a_lo = vector([a1, a2, a3, a4, a5])
- a_hi = vector([a6, a7, a8, a9, a10])
- L = hash(zeros, a_lo)
- R = hash(a_hi, zeros)
- P = hash(a_lo, a_hi)
- # Same value
- assert P == A
- a_prime = x * a_lo + x^-1 * a_hi
- assert len(a_prime) == 5
- # See section 3 of the bulletproofs paper
- P_prime = hash(x^-1 * a_prime, x * a_prime)
- assert P_prime == int(x^2) * L + P + int(x^-2) * R
- # Proof is 5 + 2 elements instead of 10 commitments to each value a_i
- proof = (L, R, a)
- # Using dot product notation, we can write:
- #
- # P_prime = <a_prime, G>
- # = <x a_lo + x^-1 a_hi, x^-1 G_lo + x G_hi>
- # = <a_lo, G_lo> + <a_hi, G_hi> + x^2 <a_lo, G_hi> + x^-2 <a_hi, G_lo>
- # = P + x^2 L + x^-2 R
- #
- # See also P_{k - 1} from:
- # https://doc-internal.dalek.rs/bulletproofs/notes/inner_product_proof/index.html
|
