pub fn compute_verification_scalars_with_rng<T: RngCore + CryptoRng>(
        &self,
        bp_gens: &BulletproofGens,
        transcript: &mut Transcript,
        value_commitments: &[CompressedRistretto],
        n: usize,
        rng: &mut T,
    ) -> Result<Vec<Scalar>, ProofError> {
        let m = value_commitments.len();

        // First, replay the "interactive" protocol using the proof
        // data to recompute all challenges.
        if !(n == 8 || n == 16 || n == 32 || n == 64) {
            return Err(ProofError::InvalidBitsize);
        }
        if bp_gens.gens_capacity < n {
            return Err(ProofError::InvalidGeneratorsLength);
        }
        if bp_gens.party_capacity < m {
            return Err(ProofError::InvalidGeneratorsLength);
        }

        transcript.rangeproof_domain_sep(n as u64, m as u64);

        for V in value_commitments.iter() {
            // Allow the commitments to be zero (0 value, 0 blinding)
            // See https://github.com/dalek-cryptography/bulletproofs/pull/248#discussion_r255167177
            transcript.append_point(b"V", V);
        }

        transcript.validate_and_append_point(b"A", &self.A)?;
        transcript.validate_and_append_point(b"S", &self.S)?;

        let y = transcript.challenge_scalar(b"y");
        let z = transcript.challenge_scalar(b"z");
        let zz = z * z;
        let minus_z = -z;

        transcript.validate_and_append_point(b"T_1", &self.T_1)?;
        transcript.validate_and_append_point(b"T_2", &self.T_2)?;

        let x = transcript.challenge_scalar(b"x");

        transcript.append_scalar(b"t_x", &self.t_x);
        transcript.append_scalar(b"t_x_blinding", &self.t_x_blinding);
        transcript.append_scalar(b"e_blinding", &self.e_blinding);

        let w = transcript.challenge_scalar(b"w");

        // Challenge value for batching statements to be verified
        let c = Scalar::random(rng);

        let (mut x_sq, mut x_inv_sq, s) = self.ipp_proof.verification_scalars(n * m, transcript)?;
        let s_inv = s.iter().rev();

        let a = self.ipp_proof.a;
        let b = self.ipp_proof.b;

        // Construct concat_z_and_2, an iterator of the values of
        // z^0 * \vec(2)^n || z^1 * \vec(2)^n || ... || z^(m-1) * \vec(2)^n
        let powers_of_2: Vec<Scalar> = util::exp_iter(Scalar::from(2u64)).take(n).collect();
        let concat_z_and_2: Vec<Scalar> = util::exp_iter(z)
            .take(m)
            .flat_map(|exp_z| powers_of_2.iter().map(move |exp_2| exp_2 * exp_z))
            .collect();

        let mut g: Vec<Scalar> = s.iter().map(|s_i| minus_z - a * s_i).collect();
        let mut h: Vec<Scalar> = s_inv
            .zip(util::exp_iter(y.invert()))
            .zip(concat_z_and_2.iter())
            .map(|((s_i_inv, exp_y_inv), z_and_2)| z + exp_y_inv * (zz * z_and_2 - b * s_i_inv))
            .collect();

        let mut value_commitment_scalars: Vec<Scalar> = util::exp_iter(z)
            .take(m)
            .map(|z_exp| c * zz * z_exp)
            .collect();
        let basepoint_scalar = w * (self.t_x - a * b) + c * (delta(n, m, &y, &z) - self.t_x);

        let mut scalars = vec![
            Scalar::one(), // A
            x,             // S
            c * x,         // T_1
            c * x * x,
        ]; //T_2
        scalars.append(&mut x_sq); // L_vec TODO avoid append, better chaining iterators
        scalars.append(&mut x_inv_sq); // R_vec
        scalars.append(&mut value_commitment_scalars); //Value com
        scalars.push(-self.e_blinding - c * self.t_x_blinding); // B_blinding
        scalars.push(basepoint_scalar); // B
        scalars.append(&mut g); // G_vec
        scalars.append(&mut h); // H_vec
        Ok(scalars)
    }
/// Compute multiexponentiation scalars needed to verify this proofs
Compute multiexponentiation scalars needed to verify this proofs
Compute multiexponentiation scalars needed to verify this proofs
pub fn compute_verification_scalars_with_rng<T: RngCore + CryptoRng>(
        &self,
        bp_gens: &BulletproofGens,
        transcript: &mut Transcript,
        value_commitments: &[CompressedRistretto],
        n: usize,
        rng: &mut T,
    ) -> Result<Vec<Scalar>, ProofError> {
        let m = value_commitments.len();
        // First, replay the "interactive" protocol using the proof
        // data to recompute all challenges.
        if !(n == 8 || n == 16 || n == 32 || n == 64) {
            return Err(ProofError::InvalidBitsize);
        }
        if bp_gens.gens_capacity < n {
            return Err(ProofError::InvalidGeneratorsLength);
        }
        if bp_gens.party_capacity < m {
            return Err(ProofError::InvalidGeneratorsLength);
        }
        transcript.rangeproof_domain_sep(n as u64, m as u64);
        for V in value_commitments.iter() {
            // Allow the commitments to be zero (0 value, 0 blinding)
            // See https://github.com/dalek-cryptography/bulletproofs/pull/248#discussion_r255167177
            transcript.append_point(b"V", V);
        }
        transcript.validate_and_append_point(b"A", &self.A)?;
        transcript.validate_and_append_point(b"S", &self.S)?;
        let y = transcript.challenge_scalar(b"y");
        let z = transcript.challenge_scalar(b"z");
        let zz = z * z;
        let minus_z = -z;
        transcript.validate_and_append_point(b"T_1", &self.T_1)?;
        transcript.validate_and_append_point(b"T_2", &self.T_2)?;
        let x = transcript.challenge_scalar(b"x");
        transcript.append_scalar(b"t_x", &self.t_x);
        transcript.append_scalar(b"t_x_blinding", &self.t_x_blinding);
        transcript.append_scalar(b"e_blinding", &self.e_blinding);
        let w = transcript.challenge_scalar(b"w");
        // Challenge value for batching statements to be verified
        let c = Scalar::random(rng);
        let (mut x_sq, mut x_inv_sq, s) = self.ipp_proof.verification_scalars(n * m, transcript)?;
        let s_inv = s.iter().rev();
        let a = self.ipp_proof.a;
        let b = self.ipp_proof.b;
        // Construct concat_z_and_2, an iterator of the values of
        // z^0 * \vec(2)^n || z^1 * \vec(2)^n || ... || z^(m-1) * \vec(2)^n
        let powers_of_2: Vec<Scalar> = util::exp_iter(Scalar::from(2u64)).take(n).collect();
        let concat_z_and_2: Vec<Scalar> = util::exp_iter(z)
            .take(m)
            .flat_map(|exp_z| powers_of_2.iter().map(move |exp_2| exp_2 * exp_z))
            .collect();
        let mut g: Vec<Scalar> = s.iter().map(|s_i| minus_z - a * s_i).collect();
        let mut h: Vec<Scalar> = s_inv
            .zip(util::exp_iter(y.invert()))
            .zip(concat_z_and_2.iter())
            .map(|((s_i_inv, exp_y_inv), z_and_2)| z + exp_y_inv * (zz * z_and_2 - b * s_i_inv))
            .collect();
        let mut value_commitment_scalars: Vec<Scalar> = util::exp_iter(z)
            .take(m)
            .map(|z_exp| c * zz * z_exp)
            .collect();
        let basepoint_scalar = w * (self.t_x - a * b) + c * (delta(n, m, &y, &z) - self.t_x);
        let mut scalars = vec![
            Scalar::one(), // A
            x,             // S
            c * x,         // T_1
            c * x * x,
        ]; //T_2
        scalars.append(&mut x_sq); // L_vec TODO avoid append, better chaining iterators
        scalars.append(&mut x_inv_sq); // R_vec
        scalars.append(&mut value_commitment_scalars); //Value com
        scalars.push(-self.e_blinding - c * self.t_x_blinding); // B_blinding
        scalars.push(basepoint_scalar); // B
        scalars.append(&mut g); // G_vec
        scalars.append(&mut h); // H_vec
        Ok(scalars)
    }
pub fn compute_verification_scalars_with_rng < T : RngCore + CryptoRng > ( & self , bp_gens : & BulletproofGens , transcript : & mut Transcript , value_commitments : & [ CompressedRistretto ] , n : usize , rng : & mut T , ) -> Result < Vec < Scalar > , ProofError > { let m = value_commitments . len ( ) ; // First, replay the "interactive" protocol using the proof // data to recompute all challenges. if ! ( n == 8 || n == 16 || n == 32 || n == 64 ) { return Err ( ProofError :: InvalidBitsize ) ; } if bp_gens . gens_capacity < n { return Err ( ProofError :: InvalidGeneratorsLength ) ; } if bp_gens . party_capacity < m { return Err ( ProofError :: InvalidGeneratorsLength ) ; } transcript . rangeproof_domain_sep ( n as u64 , m as u64 ) ; for V in value_commitments . iter ( ) { // Allow the commitments to be zero (0 value, 0 blinding) // See https://github.com/dalek-cryptography/bulletproofs/pull/248#discussion_r255167177 transcript . append_point ( b" " , V ) ; } transcript . validate_and_append_point ( b" " , & self . A ) ? ; transcript . validate_and_append_point ( b" " , & self . S ) ? ; let y = transcript . challenge_scalar ( b" " ) ; let z = transcript . challenge_scalar ( b" " ) ; let zz = z * z ; let minus_z = - z ; transcript . validate_and_append_point ( b" " , & self . T_1 ) ? ; transcript . validate_and_append_point ( b" " , & self . T_2 ) ? ; let x = transcript . challenge_scalar ( b" " ) ; transcript . append_scalar ( b" " , & self . t_x ) ; transcript . append_scalar ( b" " , & self . t_x_blinding ) ; transcript . append_scalar ( b" " , & self . e_blinding ) ; let w = transcript . challenge_scalar ( b" " ) ; // Challenge value for batching statements to be verified let c = Scalar :: random ( rng ) ; let ( mut x_sq , mut x_inv_sq , s ) = self . ipp_proof . verification_scalars ( n * m , transcript ) ? ; let s_inv = s . iter ( ) . rev ( ) ; let a = self . ipp_proof . a ; let b = self . ipp_proof . b ; // Construct concat_z_and_2, an iterator of the values of // z^0 * \vec(2)^n || z^1 * \vec(2)^n || ... || z^(m-1) * \vec(2)^n let powers_of_2 : Vec < Scalar > = util :: exp_iter ( Scalar :: from ( 2u64 ) ) . take ( n ) . collect ( ) ; let concat_z_and_2 : Vec < Scalar > = util :: exp_iter ( z ) . take ( m ) . flat_map ( | exp_z | powers_of_2 . iter ( ) . map ( move | exp_2 | exp_2 * exp_z ) ) . collect ( ) ; let mut g : Vec < Scalar > = s . iter ( ) . map ( | s_i | minus_z - a * s_i ) . collect ( ) ; let mut h : Vec < Scalar > = s_inv . zip ( util :: exp_iter ( y . invert ( ) ) ) . zip ( concat_z_and_2 . iter ( ) ) . map ( | ( ( s_i_inv , exp_y_inv ) , z_and_2 ) | z + exp_y_inv * ( zz * z_and_2 - b * s_i_inv ) ) . collect ( ) ; let mut value_commitment_scalars : Vec < Scalar > = util :: exp_iter ( z ) . take ( m ) . map ( | z_exp | c * zz * z_exp ) . collect ( ) ; let basepoint_scalar = w * ( self . t_x - a * b ) + c * ( delta ( n , m , & y , & z ) - self . t_x ) ; let mut scalars = vec ! [ Scalar one ( ) // A x // S c x // T_1 c x x ] ; //T_2 scalars . append ( & mut x_sq ) ; // L_vec TODO avoid append, better chaining iterators scalars . append ( & mut x_inv_sq ) ; // R_vec scalars . append ( & mut value_commitment_scalars ) ; //Value com scalars . push ( - self . e_blinding - c * self . t_x_blinding ) ; // B_blinding scalars . push ( basepoint_scalar ) ; // B scalars . append ( & mut g ) ; // G_vec scalars . append ( & mut h ) ; // H_vec Ok ( scalars ) }
Compute multiexponentiation scalars needed to verify this proofs
Compute multiexponentiation scalars needed to verify this proofs
&self
bp_gens
&BulletproofGens
transcript
&mut Transcript
value_commitments
&[CompressedRistretto]
n
usize
rng
&mut T
&self
bp_gens
&BulletproofGens
transcript
&mut Transcript
value_commitments
&[CompressedRistretto]
n
usize
rng
&mut T