Skip to content

Commit 50c8ca1

Browse files
committed
bulletproofs: add module, full support for rangeproofs
1 parent 385f602 commit 50c8ca1

12 files changed

+2560
-0
lines changed

.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ bench_recover
88
bench_internal
99
bench_generator
1010
bench_rangeproof
11+
bench_bulletproof
1112
tests
1213
exhaustive_tests
1314
gen_context

Makefile.am

+4
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,10 @@ if ENABLE_MODULE_RANGEPROOF
194194
include src/modules/rangeproof/Makefile.am.include
195195
endif
196196

197+
if ENABLE_MODULE_BULLETPROOF
198+
include src/modules/bulletproofs/Makefile.am.include
199+
endif
200+
197201
if ENABLE_MODULE_WHITELIST
198202
include src/modules/whitelist/Makefile.am.include
199203
endif

configure.ac

+24
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,12 @@ AC_ARG_ENABLE(module_rangeproof,
149149
[enable_module_rangeproof=$enableval],
150150
[enable_module_rangeproof=no])
151151

152+
AC_ARG_ENABLE(module_bulletproof,
153+
AS_HELP_STRING([--enable-module-bulletproof],[enable Pedersen / zero-knowledge bulletproofs module (default is no)]),
154+
[enable_module_bulletproof=$enableval],
155+
[enable_module_bulletproof=no])
156+
157+
152158
AC_ARG_ENABLE(module_whitelist,
153159
AS_HELP_STRING([--enable-module-whitelist],[enable key whitelisting module (default is no)]),
154160
[enable_module_whitelist=$enableval],
@@ -484,6 +490,10 @@ if test x"$enable_module_rangeproof" = x"yes"; then
484490
AC_DEFINE(ENABLE_MODULE_RANGEPROOF, 1, [Define this symbol to enable the zero knowledge range proof module])
485491
fi
486492

493+
if test x"$enable_module_bulletproof" = x"yes"; then
494+
AC_DEFINE(ENABLE_MODULE_BULLETPROOF, 1, [Define this symbol to enable the Pedersen / zero knowledge bulletproof module])
495+
fi
496+
487497
if test x"$enable_module_whitelist" = x"yes"; then
488498
AC_DEFINE(ENABLE_MODULE_WHITELIST, 1, [Define this symbol to enable the key whitelisting module])
489499
fi
@@ -518,6 +528,7 @@ if test x"$enable_experimental" = x"yes"; then
518528
AC_MSG_NOTICE([Building NUMS generator module: $enable_module_generator])
519529
AC_MSG_NOTICE([Building Pedersen commitment module: $enable_module_commitment])
520530
AC_MSG_NOTICE([Building range proof module: $enable_module_rangeproof])
531+
AC_MSG_NOTICE([Building bulletproof module: $enable_module_bulletproof])
521532
AC_MSG_NOTICE([Building key whitelisting module: $enable_module_whitelist])
522533
AC_MSG_NOTICE([Building surjection proof module: $enable_module_surjectionproof])
523534
AC_MSG_NOTICE([******])
@@ -532,6 +543,15 @@ if test x"$enable_experimental" = x"yes"; then
532543
if test x"$enable_module_rangeproof" = x"yes"; then
533544
AC_MSG_ERROR([Rangeproof module requires the commitment module. Use --enable-module-commitment to allow.])
534545
fi
546+
if test x"$enable_module_bulletproof" = x"yes"; then
547+
AC_MSG_ERROR([Bulletproof module requires the commitment module. Use --enable-module-commitment to allow.])
548+
fi
549+
fi
550+
551+
if test x"$enable_module_generator" != x"yes"; then
552+
if test x"$enable_module_bulletproof" = x"yes"; then
553+
AC_MSG_ERROR([Bulletproof module requires the generator module. Use --enable-module-generator to allow.])
554+
fi
535555
fi
536556

537557
if test x"$enable_module_rangeproof" != x"yes"; then
@@ -558,6 +578,9 @@ else
558578
if test x"$enable_module_rangeproof" = x"yes"; then
559579
AC_MSG_ERROR([Range proof module is experimental. Use --enable-experimental to allow.])
560580
fi
581+
if test x"$enable_module_bulletproof" = x"yes"; then
582+
AC_MSG_ERROR([Bulletproof module is experimental. Use --enable-experimental to allow.])
583+
fi
561584
if test x"$enable_module_whitelist" = x"yes"; then
562585
AC_MSG_ERROR([Key whitelisting module is experimental. Use --enable-experimental to allow.])
563586
fi
@@ -583,6 +606,7 @@ AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"ye
583606
AM_CONDITIONAL([ENABLE_MODULE_GENERATOR], [test x"$enable_module_generator" = x"yes"])
584607
AM_CONDITIONAL([ENABLE_MODULE_COMMITMENT], [test x"$enable_module_commitment" = x"yes"])
585608
AM_CONDITIONAL([ENABLE_MODULE_RANGEPROOF], [test x"$enable_module_rangeproof" = x"yes"])
609+
AM_CONDITIONAL([ENABLE_MODULE_BULLETPROOF], [test x"$enable_module_bulletproof" = x"yes"])
586610
AM_CONDITIONAL([ENABLE_MODULE_WHITELIST], [test x"$enable_module_whitelist" = x"yes"])
587611
AM_CONDITIONAL([USE_JNI], [test x"$use_jni" == x"yes"])
588612
AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$use_external_asm" = x"yes"])

include/secp256k1_bulletproofs.h

+155
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
#ifndef _SECP256K1_BULLETPROOF_
2+
# define _SECP256K1_BULLETPROOF_
3+
4+
# include "secp256k1.h"
5+
# include "secp256k1_generator.h"
6+
# include "secp256k1_rangeproof.h"
7+
8+
# ifdef __cplusplus
9+
extern "C" {
10+
# endif
11+
12+
/** Opaque structure representing a large number of NUMS generators */
13+
typedef struct secp256k1_bulletproof_generators secp256k1_bulletproof_generators;
14+
15+
/** Version number used in header of circuit and circuit-assignment binary files */
16+
#define SECP256K1_BULLETPROOF_CIRCUIT_VERSION 1
17+
18+
/* Maximum depth of 31 lets us validate an aggregate of 2^25 64-bit proofs */
19+
#define SECP256K1_BULLETPROOF_MAX_DEPTH 60
20+
21+
/* Size of a hypothetical 31-depth rangeproof, in bytes */
22+
#define SECP256K1_BULLETPROOF_MAX_PROOF (160 + 66*32 + 7)
23+
24+
/* Maximum memory, in bytes, that may be allocated to store a circuit representation */
25+
#define SECP256K1_BULLETPROOF_MAX_CIRCUIT (1024 * 1024 * 1024)
26+
27+
/** Allocates and initializes a list of NUMS generators, along with precomputation data
28+
* Currently `precomp_n` should always be set to 1, since precomputation is not used anywhere.
29+
* Returns a list of generators, or NULL if allocation failed.
30+
* Args: ctx: pointer to a context object (cannot be NULL)
31+
* In: blinding_gen: generator that blinding factors will be multiplied by (cannot be NULL)
32+
* n: number of NUMS generators to produce
33+
* precomp_n: for each NUMS generator, plus the blinding factor generator, how many multiples to precompute
34+
*/
35+
SECP256K1_API secp256k1_bulletproof_generators *secp256k1_bulletproof_generators_create(
36+
const secp256k1_context* ctx,
37+
const secp256k1_generator *blinding_gen,
38+
size_t n,
39+
size_t precomp_n
40+
) SECP256K1_ARG_NONNULL(1);
41+
42+
/** Destroys a list of NUMS generators
43+
* Args: ctx: pointer to a context object (cannot be NULL)
44+
* gen: pointer to the generator set to be destroyed
45+
*/
46+
SECP256K1_API void secp256k1_bulletproof_generators_destroy(
47+
const secp256k1_context* ctx,
48+
secp256k1_bulletproof_generators *gen
49+
) SECP256K1_ARG_NONNULL(1);
50+
51+
/** Verifies a single bulletproof (aggregate) rangeproof
52+
* Returns: 1: rangeproof was valid
53+
* 0: rangeproof was invalid, or out of memory
54+
* Args: ctx: pointer to a context object initialized for verification (cannot be NULL)
55+
* scratch: scratch space with enough memory for verification (cannot be NULL)
56+
* gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL)
57+
* In: proof: byte-serialized rangeproof (cannot be NULL)
58+
* plen: length of the proof
59+
* min_value: array of minimum values to prove ranges above, or NULL for all-zeroes
60+
* commit: array of pedersen commitment that this rangeproof is over (cannot be NULL)
61+
* n_commits: number of commitments in the above array (cannot be 0)
62+
* nbits: number of bits proven for each range
63+
* value_gen: generator multiplied by value in pedersen commitments (cannot be NULL)
64+
* extra_commit: additonal data committed to by the rangeproof
65+
* extra_commit_len: length of additional data
66+
*/
67+
SECP256K1_API int secp256k1_bulletproof_rangeproof_verify(
68+
const secp256k1_context* ctx,
69+
secp256k1_scratch_space* scratch,
70+
const secp256k1_bulletproof_generators *gens,
71+
const unsigned char* proof,
72+
size_t plen,
73+
const uint64_t* min_value,
74+
const secp256k1_pedersen_commitment* commit,
75+
size_t n_commits,
76+
size_t nbits,
77+
const secp256k1_generator* value_gen,
78+
const unsigned char* extra_commit,
79+
size_t extra_commit_len
80+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(10);
81+
82+
/** Batch-verifies multiple bulletproof (aggregate) rangeproofs of the same size using same generator
83+
* Returns: 1: all rangeproofs were valid
84+
* 0: some rangeproof was invalid, or out of memory
85+
* Args: ctx: pointer to a context object initialized for verification (cannot be NULL)
86+
* scratch: scratch space with enough memory for verification (cannot be NULL)
87+
* gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL)
88+
* In: proof: array of byte-serialized rangeproofs (cannot be NULL)
89+
* n_proofs: number of proofs in the above array, and number of arrays in the `commit` array
90+
* plen: length of every individual proof
91+
* min_value: array of arrays of minimum values to prove ranges above, or NULL for all-zeroes
92+
* commit: array of arrays of pedersen commitment that the rangeproofs is over (cannot be NULL)
93+
* n_commits: number of commitments in each element of the above array (cannot be 0)
94+
* nbits: number of bits in each proof
95+
* value_gen: generator multiplied by value in pedersen commitments (cannot be NULL)
96+
* extra_commit: array of additonal data committed to by the rangeproof
97+
* extra_commit_len: array of lengths of additional data
98+
*/
99+
SECP256K1_API int secp256k1_bulletproof_rangeproof_verify_multi(
100+
const secp256k1_context* ctx,
101+
secp256k1_scratch_space* scratch,
102+
const secp256k1_bulletproof_generators *gens,
103+
const unsigned char* const* proof,
104+
size_t n_proofs,
105+
size_t plen,
106+
const uint64_t* const* min_value,
107+
const secp256k1_pedersen_commitment* const* commit,
108+
size_t n_commits,
109+
size_t nbits,
110+
const secp256k1_generator* value_gen,
111+
const unsigned char* const* extra_commit,
112+
size_t *extra_commit_len
113+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(8);
114+
115+
116+
/** Produces an aggregate Bulletproof rangeproof for a set of Pedersen commitments
117+
* Returns: 1: rangeproof was successfully created
118+
* 0: rangeproof could not be created, or out of memory
119+
* Args: ctx: pointer to a context object initialized for signing and verification (cannot be NULL)
120+
* scratch: scratch space with enough memory for verification (cannot be NULL)
121+
* gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL)
122+
* Out: proof: byte-serialized rangeproof (cannot be NULL)
123+
* In/out: plen: pointer to size of `proof`, to be replaced with actual length of proof (cannot be NULL)
124+
* In: value: array of values committed by the Pedersen commitments (cannot be NULL)
125+
* min_value: array of minimum values to prove ranges above, or NULL for all-zeroes
126+
* blind: array of blinding factors of the Pedersen commitments (cannot be NULL)
127+
* n_commits: number of entries in the `value` and `blind` arrays
128+
* value_gen: generator multiplied by value in pedersen commitments (cannot be NULL)
129+
* nbits: number of bits proven for each range
130+
* nonce: random 32-byte seed used to derive blinding factors (cannot be NULL)
131+
* extra_commit: additonal data committed to by the rangeproof
132+
* extra_commit_len: length of additional data
133+
*/
134+
SECP256K1_API int secp256k1_bulletproof_rangeproof_prove(
135+
const secp256k1_context* ctx,
136+
secp256k1_scratch_space* scratch,
137+
const secp256k1_bulletproof_generators *gens,
138+
unsigned char* proof,
139+
size_t* plen,
140+
const uint64_t *value,
141+
const uint64_t *min_value,
142+
const unsigned char* const* blind,
143+
size_t n_commits,
144+
const secp256k1_generator* value_gen,
145+
size_t nbits,
146+
const unsigned char* nonce,
147+
const unsigned char* extra_commit,
148+
size_t extra_commit_len
149+
) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(8) SECP256K1_ARG_NONNULL(10) SECP256K1_ARG_NONNULL(12);
150+
151+
# ifdef __cplusplus
152+
}
153+
# endif
154+
155+
#endif
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
include_HEADERS += include/secp256k1_bulletproofs.h
2+
noinst_HEADERS += src/modules/bulletproofs/inner_product_impl.h
3+
noinst_HEADERS += src/modules/bulletproofs/rangeproof_impl.h
4+
noinst_HEADERS += src/modules/bulletproofs/main_impl.h
5+
noinst_HEADERS += src/modules/bulletproofs/tests_impl.h
6+
noinst_HEADERS += src/modules/bulletproofs/util.h

0 commit comments

Comments
 (0)