Inverse CIDR whitelist The task

The task is to write a program that turns a list of IPv6 addresses into a shortest possible list of CIDR masks, such that everything but those IPs is matched. 

CIDR masks

A CIDR mask matches IPs by a prefix. ::/19 matches all IPs whose first 19 bits are zero, i.e. 0:0000-1fff:*:*:*:*:*:*. Similarly, 55aa::/16 matches all IPs that start with 0101010110101010 bit sequence, i.e. 55aa:*:*:*:*:*:*:*.
A /128 always matches only one IP. A /0 matches all IPs.

Input

Input is a list of IP addresses in full form: eight 4-digit hexadecimal groups separated by : in network order (most significant first). For example, 0000:0000:0000:0000:0000:0000:0000:0000.
You're free to choose any separation character for the input list, might it be newline, space, comma, \0, etc. You can also rely on a-f being in a particular case.

Output

Output is the shortest list of CIDR masks that cover all IP addresses except those listed in input.
Again you're free to choose any separation character.
The CIDR should be formatted as any representation of an IP followed by / and amount of bits in the prefix (in decimal). For example, 0243:F6A8:885A:308D:3131:98A2:0000:0000/112.
You are not required to shorten the IP at all, as in above example. However 243:f6a8:885a:308d:3131:98a2::/112 is not invalid.
The order of masks doesn't matter. If there are multiple representations using equal amount of masks - either will suffice.

Examples

I'm not posting complete outputs, since coming up with an algorithm is a part of the task :)
Instead I'm specifying how much masks does it take, according to my own calculations. If you find a mistake, or a shorter masklist, please report.

&gt;&gt;&gt; 0000:0000:0000:0000:0000:0000:0000:0000
 [128 masks]
&gt;&gt;&gt; 0000:0000:0000:0000:0000:0000:0000:0000 0000:0000:0000:0000:0000:0000:0000:0001
 [127 masks]
&gt;&gt;&gt; ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 0000:0000:0000:0000:0000:0000:0000:0000
 [254 masks]
&gt;&gt;&gt; 0000:0000:0000:0000:0000:0000:0000:ffff 0000:0000:0000:0000:0000:0000:0000:0000
 [142 masks]
&gt;&gt;&gt; 0123:4567:89ab:cdef:fedc:ba98:7654:3210 0246:8ace:1357:9bdf:0246:8ace:1357:9bdf
 [248 masks]
&gt;&gt;&gt; 0000:0000:0000:0000:0000:0000:0000:0000 0000:0000:0001:0000:0000:0000:0000:0000 0000:0000:0002:0000:0000:0000:0000:0000 0000:0000:0003:0000:0000:0000:0000:0000 0000:0000:0004:0000:0000:0000:0000:0000 &lt; snip &gt; 0000:0000:00ff:0000:0000:0000:0000:0000
 (256 IPs)
 [20520 masks]
&gt;&gt;&gt; 0000:0000:0000:0000:0000:0000:0000:0000 0000:0000:0000:0000:0000:0000:0000:0001 0000:0000:0000:0000:0000:0000:0000:0002 0000:0000:0000:0000:0000:0000:0000:0003 0000:0000:0000:0000:0000:0000:0000:0004 &lt; snip &gt; 0000:0000:0000:0000:0000:0000:0000:0fff
 (4096 IPs)
 [116 masks]


Scoring

Amount of characters in the code, UTF-8 characters are counted as one, if you must.

Bonus points


-16  Cover the case of empty input list.
-32  Output shortened IPs: strip leading zeros, replace sequential zero groups with ::, etc. See this Wikipedia article.

-32 Do not use the v4-in-v6 form (dead::beef:1.2.3.4).

-64  Permit shortened IPs in input.
GolfScript, 120 (136 characters - 16 bonus)
n%{':'-{48^71%}%16base}%-1+2.7??:W+${\)1$1$-{}{129,-1%{2\?.2$)&lt;3$@%!&amp;}?:~2$W+16base(;{.48+\9&gt;39*+}%4/':'*'/'+128@-+puts\2~?+\2~?-}/;;}*;

Assumes the addresses as separate lines on STDIN. A considerable amount of the code is actually used to input/output in the correct format. The algorithm itself is quite simple and described here.