WIP: bulletproofs #16

apoelstra · 2017-11-27T19:00:29Z

Based on rebase of strauss-multiexp from upstream onto -zkp

~~TODO rangeproof aggregation~~
~~TODO const time proving~~
~~TODO pippenger support~~
TODO 48-bit (and generally non-power-of-2) rangeproofs and aggregates
~~TODO general arithmetic circuit support~~

apoelstra · 2018-01-19T01:01:45Z

src/modules/bulletproof/rangeproof_impl.h

+    /* Compute Ti = t_i*A + tau_i*G for i = 1,2 */
+    secp256k1_gej_set_ge(&tmpj, genp);
+    secp256k1_ecmult(ecmult_ctx, &tj[0], &tmpj, &t1, &tau1);
+    secp256k1_ecmult(ecmult_ctx, &tj[1], &tmpj, &t2, &tau2);


Both these ecmult need to be constant time since tau1 and tau2 are secrets.

jonasnick · 2018-02-02T09:32:18Z

Doesn't compile:

./src/modules/bulletproof/inner_product_impl.h:49:33: error: ‘MAX_BATCH_QTY’ undeclared here (not in a function)
     secp256k1_scalar randomizer[MAX_BATCH_QTY];

apoelstra · 2018-02-02T10:04:30Z

Try now? that constant is defined in include/secp256k1_bulletproofs.h, maybe I forgot to commit that in an earlier patchset.

jonasnick · 2018-02-02T10:07:03Z

Looks like some files in the circuits directory are missing:

src/bench_bulletproof.c:16:18: fatal error: src/modules/bulletproof/circuits/jubjub-3072.circuit: No such file or directory
 #define FILENAME "src/modules/bulletproof/circuits/jubjub-3072.circuit"

jonasnick · 2018-02-02T11:05:20Z

src/modules/bulletproof/parser_impl.h

+            row = &w[index];
+
+            row->size++;
+            row->entry = checked_realloc(&ctx->error_callback, row->entry, row->size * sizeof(*row->entry));


row->entry is never freed

jonasnick · 2018-02-02T11:05:58Z

src/modules/bulletproof/parser_impl.h

+    ret->wv = (secp256k1_bulletproof_wmatrix_row *)checked_malloc(&ctx->error_callback, ret->n_commits * sizeof(*ret->wv));
+    ret->c = (secp256k1_scalar *)checked_malloc(&ctx->error_callback, ret->n_constraints * sizeof(*ret->wl));
+
+    ret->scratch = (secp256k1_scalar *)checked_malloc(&ctx->error_callback, ret->n_constraints * sizeof(*ret->scratch));


scratch is never freed

benma · 2018-03-13T11:13:23Z

Got a compilation error:

$ make 
  CCLD     exhaustive_tests
src/exhaustive_tests-tests_exhaustive.o: In function `secp256k1_bulletproof_circuit_prove':
secp256k1-zkp/src/modules/bulletproof/circuits/jubjub-3072.assn:1: undefined reference to `SECP256K1_SCALAR_CONST'

apoelstra · 2018-03-13T13:06:22Z

@benma sorry, you have to disable exhaustive tests for now.

apoelstra · 2018-03-13T15:26:50Z

update with current state, rebase on current secp256k1-zkp branch. still very much WIP

apoelstra · 2018-03-31T16:13:08Z

@sipa When you get a chance, can you take a look at my rebase branch at https://github.com/apoelstra/secp256k1-mw/tree/secp256k1-zkp-rebase ?

Aside from the rebase, I think this PR is ready for review.

apoelstra · 2018-10-10T02:00:44Z

Rebased on #23

…oof_init_p_give_up Add comment to explain effect of max_n_iterations in surjectionproof_…

…commitments We now use ecmult_const rather than ecmult_gen, which will slow down the generation of Pedersen commitments. However as far as I'm aware, this is never the bottleneck in proof generation.

…m Ruffing)

…e expired TODOs

…ent timeout

jonasnick

I added a couple of fixes and clarifications to my musig-dn branch (https://github.com/jonasnick/secp256k1-zkp/tree/bulletproof-musig-dn). Feel free to cherry-pick.

e34a03e Document that bulletproof_circuit_prove blinding factors can not be 0
912741d Fix unintialized memory in bulletproof circuit verify if nr of multiplication gates is not a power of 2
acf9efe Fix heap overflow when bulletproving a circuit without constraints
745f6a5 Document secp256k1_bulletproof_circuit_decode format
a9f3a2c bulletproof example
70e8c71 Add ability to evaluate an arithmetic circuit with a given assignment
9fe6454 Allow committing to an arbitrary value and not only a 64 bit int
66cad17 Add function to compare bulletproof circuits

jonasnick · 2020-01-23T16:19:01Z

src/modules/bulletproofs/main_impl.h

+        fclose(fh);
+        return NULL;
+    }
+    row_width = secp256k1_bulletproof_encoding_width(ret->n_gates);


shouldn't row_width be dependent on the n_constraints instead of n_gates? Every entry in a row encodes the index of the constraint (also encoded with row_width-many bytes) the wire is added to and the factor the wire is multiplied with in that constraint. Therefore there are at most n_constraint many entries in a row.

add compact signature encoding

apoelstra · 2020-12-03T15:30:00Z

Closing this. It's good to remember that the code is here to crib from when we revisit the inner product argument, but there's no value in keeping an open PR for it.

apoelstra force-pushed the bulletproofs branch 3 times, most recently from 89d844e to c9d66d2 Compare December 4, 2017 15:49

yeastplume mentioned this pull request Dec 5, 2017

Bulletproofs mimblewimble/grin#273

Closed

apoelstra force-pushed the bulletproofs branch from c9d66d2 to f22f0c0 Compare December 10, 2017 18:10

apoelstra commented Jan 19, 2018

View reviewed changes

apoelstra force-pushed the bulletproofs branch from f22f0c0 to ab92bbf Compare January 31, 2018 07:28

jonasnick reviewed Feb 2, 2018

View reviewed changes

apoelstra force-pushed the bulletproofs branch 2 times, most recently from 3a13492 to 1d5899f Compare March 13, 2018 15:26

apoelstra force-pushed the bulletproofs branch 3 times, most recently from d8b95b9 to 66d79b3 Compare March 15, 2018 18:12

apoelstra force-pushed the bulletproofs branch 7 times, most recently from 1043ca4 to ffdd7e5 Compare March 31, 2018 16:10

apoelstra force-pushed the bulletproofs branch 2 times, most recently from 2b50d19 to 1b2d5cc Compare April 5, 2018 12:08

apoelstra force-pushed the bulletproofs branch from 83e933f to 9fedd82 Compare October 10, 2018 02:00

Merge pull request BlockstreamResearch#19 from jonasnick/surjectionpr…

809016c

…oof_init_p_give_up Add comment to explain effect of max_n_iterations in surjectionproof_…

apoelstra force-pushed the bulletproofs branch from 9fedd82 to bc4a532 Compare October 10, 2018 02:54

apoelstra added 17 commits October 10, 2018 02:58

add chacha20 function

4642c38

generator: add constant G and H generators

c70d4bf

split Pedersen commitments out into their own module

2153239

commitment: allow setting the blinding factor generator for Pedersen …

1e8874e

…commitments We now use ecmult_const rather than ecmult_gen, which will slow down the generation of Pedersen commitments. However as far as I'm aware, this is never the bottleneck in proof generation.

bulletproofs: add module, full support for rangeproofs

7ec1d8a

bulletproofs: add rangeproof rewinding capability

cc06fdd

bulletproofs: add benchmark

92b917a

commitment and bulletproof: fix a bunch of typos and stuff (thanks Ti…

19ef4bb

…m Ruffing)

bulletproofs: extensively comment inner product proof, remove a coupl…

e1d690e

…e expired TODOs

bulletproofs: add n_commits to the hash of all rangeproof input data

7dd0d1b

add new modules to travis

26df649

rangeproof: reduce test iterations; add echo script to travis to prev…

376d4fa

…ent timeout

bulletproofs: add circuit support

aa6c5fd

bulletproofs: add a bunch of binary example circuits

c26bc86

bulletproofs: extend API tests to cover circuits, fix existing tests

159060d

bulletproofs: add binary circuit with a committed input, test it

f308664

bulletproofs: add benchmark

9c3ba0c

apoelstra force-pushed the bulletproofs branch from bc4a532 to 9c3ba0c Compare October 10, 2018 02:59

apoelstra force-pushed the secp256k1-zkp branch from e100037 to 53ad841 Compare December 14, 2018 20:46

apoelstra force-pushed the secp256k1-zkp branch from bcabca9 to 6f3b0c0 Compare May 30, 2019 15:28

jonasnick reviewed Jan 23, 2020

View reviewed changes

tomtau pushed a commit to crypto-com/secp256k1-zkp that referenced this pull request Jul 9, 2020

Merge pull request BlockstreamResearch#16 from apoelstra/compact-sig

e69fedb

add compact signature encoding

jonasnick force-pushed the secp256k1-zkp branch from dc4181a to fabc8f7 Compare July 24, 2020 19:52

apoelstra closed this Dec 3, 2020

sgeisler mentioned this pull request Jun 14, 2021

secp256k1 support dalek-cryptography/bulletproofs#333

Closed

WIP: bulletproofs #16

WIP: bulletproofs #16

apoelstra commented Nov 27, 2017 •

edited

apoelstra Jan 19, 2018

jonasnick commented Feb 2, 2018

apoelstra commented Feb 2, 2018

jonasnick commented Feb 2, 2018

jonasnick Feb 2, 2018

jonasnick Feb 2, 2018

benma commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 31, 2018

apoelstra commented Oct 10, 2018

jonasnick left a comment •

edited

jonasnick Jan 23, 2020

apoelstra commented Dec 3, 2020

WIP: bulletproofs #16

WIP: bulletproofs #16

Conversation

apoelstra commented Nov 27, 2017 • edited

apoelstra Jan 19, 2018

Choose a reason for hiding this comment

jonasnick commented Feb 2, 2018

apoelstra commented Feb 2, 2018

jonasnick commented Feb 2, 2018

jonasnick Feb 2, 2018

Choose a reason for hiding this comment

jonasnick Feb 2, 2018

Choose a reason for hiding this comment

benma commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 31, 2018

apoelstra commented Oct 10, 2018

jonasnick left a comment • edited

Choose a reason for hiding this comment

jonasnick Jan 23, 2020

Choose a reason for hiding this comment

apoelstra commented Dec 3, 2020

apoelstra commented Nov 27, 2017 •

edited

jonasnick left a comment •

edited