|
| 1 | +#ifndef _SECP256K1_BULLETPROOF_ |
| 2 | +# define _SECP256K1_BULLETPROOF_ |
| 3 | + |
| 4 | +# include "secp256k1.h" |
| 5 | +# include "secp256k1_generator.h" |
| 6 | +# include "secp256k1_rangeproof.h" |
| 7 | + |
| 8 | +# ifdef __cplusplus |
| 9 | +extern "C" { |
| 10 | +# endif |
| 11 | + |
| 12 | +/** Opaque structure representing a large number of NUMS generators */ |
| 13 | +typedef struct secp256k1_bulletproof_generators secp256k1_bulletproof_generators; |
| 14 | + |
| 15 | +/* Maximum depth of 31 lets us validate an aggregate of 2^25 64-bit proofs */ |
| 16 | +#define SECP256K1_BULLETPROOF_MAX_DEPTH 31 |
| 17 | + |
| 18 | +/* Size of a hypothetical 31-depth rangeproof, in bytes */ |
| 19 | +#define SECP256K1_BULLETPROOF_MAX_PROOF (160 + 66*32 + 7) |
| 20 | + |
| 21 | +/** Allocates and initializes a list of NUMS generators, along with precomputation data |
| 22 | + * Returns a list of generators, or NULL if allocation failed. |
| 23 | + * Args: ctx: pointer to a context object (cannot be NULL) |
| 24 | + * In: blinding_gen: generator that blinding factors will be multiplied by (cannot be NULL) |
| 25 | + * n: number of NUMS generators to produce |
| 26 | + */ |
| 27 | +SECP256K1_API secp256k1_bulletproof_generators *secp256k1_bulletproof_generators_create( |
| 28 | + const secp256k1_context* ctx, |
| 29 | + const secp256k1_generator *blinding_gen, |
| 30 | + size_t n |
| 31 | +) SECP256K1_ARG_NONNULL(1); |
| 32 | + |
| 33 | +/** Destroys a list of NUMS generators, freeing allocated memory |
| 34 | + * Args: ctx: pointer to a context object (cannot be NULL) |
| 35 | + * gen: pointer to the generator set to be destroyed |
| 36 | + */ |
| 37 | +SECP256K1_API void secp256k1_bulletproof_generators_destroy( |
| 38 | + const secp256k1_context* ctx, |
| 39 | + secp256k1_bulletproof_generators *gen |
| 40 | +) SECP256K1_ARG_NONNULL(1); |
| 41 | + |
| 42 | +/** Verifies a single bulletproof (aggregate) rangeproof |
| 43 | + * Returns: 1: rangeproof was valid |
| 44 | + * 0: rangeproof was invalid, or out of memory |
| 45 | + * Args: ctx: pointer to a context object initialized for verification (cannot be NULL) |
| 46 | + * scratch: scratch space with enough memory for verification (cannot be NULL) |
| 47 | + * gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL) |
| 48 | + * In: proof: byte-serialized rangeproof (cannot be NULL) |
| 49 | + * plen: length of the proof |
| 50 | + * min_value: array of minimum values to prove ranges above, or NULL for all-zeroes |
| 51 | + * commit: array of pedersen commitment that this rangeproof is over (cannot be NULL) |
| 52 | + * n_commits: number of commitments in the above array (cannot be 0) |
| 53 | + * nbits: number of bits proven for each range |
| 54 | + * value_gen: generator multiplied by value in pedersen commitments (cannot be NULL) |
| 55 | + * extra_commit: additonal data committed to by the rangeproof (may be NULL if `extra_commit_len` is 0) |
| 56 | + * extra_commit_len: length of additional data |
| 57 | + */ |
| 58 | +SECP256K1_API int secp256k1_bulletproof_rangeproof_verify( |
| 59 | + const secp256k1_context* ctx, |
| 60 | + secp256k1_scratch_space* scratch, |
| 61 | + const secp256k1_bulletproof_generators *gens, |
| 62 | + const unsigned char* proof, |
| 63 | + size_t plen, |
| 64 | + const uint64_t* min_value, |
| 65 | + const secp256k1_pedersen_commitment* commit, |
| 66 | + size_t n_commits, |
| 67 | + size_t nbits, |
| 68 | + const secp256k1_generator* value_gen, |
| 69 | + const unsigned char* extra_commit, |
| 70 | + size_t extra_commit_len |
| 71 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(7) SECP256K1_ARG_NONNULL(10); |
| 72 | + |
| 73 | +/** Batch-verifies multiple bulletproof (aggregate) rangeproofs of the same size using same generator |
| 74 | + * Returns: 1: all rangeproofs were valid |
| 75 | + * 0: some rangeproof was invalid, or out of memory |
| 76 | + * Args: ctx: pointer to a context object initialized for verification (cannot be NULL) |
| 77 | + * scratch: scratch space with enough memory for verification (cannot be NULL) |
| 78 | + * gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL) |
| 79 | + * In: proof: array of byte-serialized rangeproofs (cannot be NULL) |
| 80 | + * n_proofs: number of proofs in the above array, and number of arrays in the `commit` array |
| 81 | + * plen: length of every individual proof |
| 82 | + * min_value: array of arrays of minimum values to prove ranges above, or NULL for all-zeroes |
| 83 | + * commit: array of arrays of pedersen commitment that the rangeproofs is over (cannot be NULL) |
| 84 | + * n_commits: number of commitments in each element of the above array (cannot be 0) |
| 85 | + * nbits: number of bits in each proof |
| 86 | + * value_gen: generator multiplied by value in pedersen commitments (cannot be NULL) |
| 87 | + * extra_commit: additonal data committed to by the rangeproof (may be NULL if `extra_commit_len` is 0) |
| 88 | + * extra_commit_len: array of lengths of additional data |
| 89 | + */ |
| 90 | +SECP256K1_API int secp256k1_bulletproof_rangeproof_verify_multi( |
| 91 | + const secp256k1_context* ctx, |
| 92 | + secp256k1_scratch_space* scratch, |
| 93 | + const secp256k1_bulletproof_generators *gens, |
| 94 | + const unsigned char* const* proof, |
| 95 | + size_t n_proofs, |
| 96 | + size_t plen, |
| 97 | + const uint64_t* const* min_value, |
| 98 | + const secp256k1_pedersen_commitment* const* commit, |
| 99 | + size_t n_commits, |
| 100 | + size_t nbits, |
| 101 | + const secp256k1_generator* value_gen, |
| 102 | + const unsigned char* const* extra_commit, |
| 103 | + size_t *extra_commit_len |
| 104 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(8); |
| 105 | + |
| 106 | + |
| 107 | +/** Produces an aggregate Bulletproof rangeproof for a set of Pedersen commitments |
| 108 | + * Returns: 1: rangeproof was successfully created |
| 109 | + * 0: rangeproof could not be created, or out of memory |
| 110 | + * Args: ctx: pointer to a context object initialized for signing and verification (cannot be NULL) |
| 111 | + * scratch: scratch space with enough memory for verification (cannot be NULL) |
| 112 | + * gens: generator set with at least 2*nbits*n_commits many generators (cannot be NULL) |
| 113 | + * Out: proof: byte-serialized rangeproof (cannot be NULL) |
| 114 | + * In/out: plen: pointer to size of `proof`, to be replaced with actual length of proof (cannot be NULL) |
| 115 | + * In: value: array of values committed by the Pedersen commitments (cannot be NULL) |
| 116 | + * min_value: array of minimum values to prove ranges above, or NULL for all-zeroes |
| 117 | + * blind: array of blinding factors of the Pedersen commitments (cannot be NULL) |
| 118 | + * n_commits: number of entries in the `value` and `blind` arrays |
| 119 | + * value_gen: generator multiplied by value in pedersen commitments (cannot be NULL) |
| 120 | + * nbits: number of bits proven for each range |
| 121 | + * nonce: random 32-byte seed used to derive blinding factors (cannot be NULL) |
| 122 | + * extra_commit: additonal data committed to by the rangeproof |
| 123 | + * extra_commit_len: length of additional data |
| 124 | + */ |
| 125 | +SECP256K1_API int secp256k1_bulletproof_rangeproof_prove( |
| 126 | + const secp256k1_context* ctx, |
| 127 | + secp256k1_scratch_space* scratch, |
| 128 | + const secp256k1_bulletproof_generators *gens, |
| 129 | + unsigned char* proof, |
| 130 | + size_t* plen, |
| 131 | + const uint64_t *value, |
| 132 | + const uint64_t *min_value, |
| 133 | + const unsigned char* const* blind, |
| 134 | + size_t n_commits, |
| 135 | + const secp256k1_generator* value_gen, |
| 136 | + size_t nbits, |
| 137 | + const unsigned char* nonce, |
| 138 | + const unsigned char* extra_commit, |
| 139 | + size_t extra_commit_len |
| 140 | +) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5) SECP256K1_ARG_NONNULL(6) SECP256K1_ARG_NONNULL(8) SECP256K1_ARG_NONNULL(10) SECP256K1_ARG_NONNULL(12); |
| 141 | + |
| 142 | +# ifdef __cplusplus |
| 143 | +} |
| 144 | +# endif |
| 145 | + |
| 146 | +#endif |
0 commit comments