WIP: bulletproofs #16

apoelstra · 2017-11-27T19:00:29Z

Based on rebase of strauss-multiexp from upstream onto -zkp

~~TODO rangeproof aggregation~~
~~TODO const time proving~~
~~TODO pippenger support~~
TODO 48-bit (and generally non-power-of-2) rangeproofs and aggregates
~~TODO general arithmetic circuit support~~

apoelstra · 2018-01-19T01:01:45Z

src/modules/bulletproof/rangeproof_impl.h

+    /* Compute Ti = t_i*A + tau_i*G for i = 1,2 */
+    secp256k1_gej_set_ge(&tmpj, genp);
+    secp256k1_ecmult(ecmult_ctx, &tj[0], &tmpj, &t1, &tau1);
+    secp256k1_ecmult(ecmult_ctx, &tj[1], &tmpj, &t2, &tau2);


Both these ecmult need to be constant time since tau1 and tau2 are secrets.

jonasnick · 2018-02-02T09:32:18Z

Doesn't compile:

./src/modules/bulletproof/inner_product_impl.h:49:33: error: ‘MAX_BATCH_QTY’ undeclared here (not in a function)
     secp256k1_scalar randomizer[MAX_BATCH_QTY];

apoelstra · 2018-02-02T10:04:30Z

Try now? that constant is defined in include/secp256k1_bulletproofs.h, maybe I forgot to commit that in an earlier patchset.

jonasnick · 2018-02-02T10:07:03Z

Looks like some files in the circuits directory are missing:

src/bench_bulletproof.c:16:18: fatal error: src/modules/bulletproof/circuits/jubjub-3072.circuit: No such file or directory
 #define FILENAME "src/modules/bulletproof/circuits/jubjub-3072.circuit"

jonasnick · 2018-02-02T11:05:20Z

src/modules/bulletproof/parser_impl.h

+            row = &w[index];
+
+            row->size++;
+            row->entry = checked_realloc(&ctx->error_callback, row->entry, row->size * sizeof(*row->entry));


row->entry is never freed

jonasnick · 2018-02-02T11:05:58Z

src/modules/bulletproof/parser_impl.h

+    ret->wv = (secp256k1_bulletproof_wmatrix_row *)checked_malloc(&ctx->error_callback, ret->n_commits * sizeof(*ret->wv));
+    ret->c = (secp256k1_scalar *)checked_malloc(&ctx->error_callback, ret->n_constraints * sizeof(*ret->wl));
+
+    ret->scratch = (secp256k1_scalar *)checked_malloc(&ctx->error_callback, ret->n_constraints * sizeof(*ret->scratch));


scratch is never freed

benma · 2018-03-13T11:13:23Z

Got a compilation error:

$ make 
  CCLD     exhaustive_tests
src/exhaustive_tests-tests_exhaustive.o: In function `secp256k1_bulletproof_circuit_prove':
secp256k1-zkp/src/modules/bulletproof/circuits/jubjub-3072.assn:1: undefined reference to `SECP256K1_SCALAR_CONST'

apoelstra · 2018-03-13T13:06:22Z

@benma sorry, you have to disable exhaustive tests for now.

apoelstra · 2018-03-13T15:26:50Z

update with current state, rebase on current secp256k1-zkp branch. still very much WIP

apoelstra · 2018-03-31T16:13:08Z

@sipa When you get a chance, can you take a look at my rebase branch at https://github.com/apoelstra/secp256k1-mw/tree/secp256k1-zkp-rebase ?

Aside from the rebase, I think this PR is ready for review.

Fix pedersen commitment serialization after #30 broke it

apoelstra · 2018-10-10T02:00:44Z

Rebased on #23

Add comment to explain effect of max_n_iterations in surjectionproof_…

…commitments We now use ecmult_const rather than ecmult_gen, which will slow down the generation of Pedersen commitments. However as far as I'm aware, this is never the bottleneck in proof generation.

…m Ruffing)

…e expired TODOs

…ent timeout

jonasnick

I added a couple of fixes and clarifications to my musig-dn branch (https://github.com/jonasnick/secp256k1-zkp/tree/bulletproof-musig-dn). Feel free to cherry-pick.

e34a03e Document that bulletproof_circuit_prove blinding factors can not be 0
912741d Fix unintialized memory in bulletproof circuit verify if nr of multiplication gates is not a power of 2
acf9efe Fix heap overflow when bulletproving a circuit without constraints
745f6a5 Document secp256k1_bulletproof_circuit_decode format
a9f3a2c bulletproof example
70e8c71 Add ability to evaluate an arithmetic circuit with a given assignment
9fe6454 Allow committing to an arbitrary value and not only a 64 bit int
66cad17 Add function to compare bulletproof circuits

jonasnick · 2020-01-23T16:22:10Z

src/modules/bulletproofs/main_impl.h

+        fclose(fh);
+        return NULL;
+    }
+    row_width = secp256k1_bulletproof_encoding_width(ret->n_gates);


shouldn't row_width be dependent on the n_constraints instead of n_gates? Every entry in a row encodes the index of the constraint (also encoded with row_width-many bytes) the wire is added to and the factor the wire is multiplied with in that constraint. Therefore there are at most n_constraint many entries in a row.

add compact signature encoding

apoelstra · 2020-12-03T15:30:00Z

Closing this. It's good to remember that the code is here to crib from when we revisit the inner product argument, but there's no value in keeping an open PR for it.

apoelstra force-pushed the apoelstra:bulletproofs branch 3 times, most recently from 89d844e to c9d66d2 Nov 27, 2017

yeastplume mentioned this pull request Dec 5, 2017

Bulletproofs mimblewimble/grin#273

Closed

apoelstra force-pushed the apoelstra:bulletproofs branch from c9d66d2 to f22f0c0 Dec 10, 2017

apoelstra reviewed Jan 19, 2018

View changes

apoelstra force-pushed the apoelstra:bulletproofs branch from f22f0c0 to ab92bbf Jan 31, 2018

jonasnick reviewed Feb 2, 2018

View changes

src/modules/bulletproof/parser_impl.h Outdated

row = &w[index];

row->size++;

row->entry = checked_realloc(&ctx->error_callback, row->entry, row->size * sizeof(*row->entry));

This comment has been minimized.

Sign in to view

jonasnick Feb 2, 2018
Contributor

row->entry is never freed

jonasnick reviewed Feb 2, 2018

View changes

apoelstra force-pushed the apoelstra:bulletproofs branch 2 times, most recently from 3a13492 to 1d5899f Mar 13, 2018

apoelstra force-pushed the apoelstra:bulletproofs branch 3 times, most recently from d8b95b9 to 66d79b3 Mar 13, 2018

apoelstra force-pushed the apoelstra:bulletproofs branch 7 times, most recently from 1043ca4 to ffdd7e5 Mar 26, 2018

apoelstra force-pushed the apoelstra:bulletproofs branch 2 times, most recently from 2b50d19 to 1b2d5cc Apr 4, 2018

apoelstra force-pushed the apoelstra:bulletproofs branch from 83e933f to 9fedd82 Oct 10, 2018

apoelstra force-pushed the apoelstra:bulletproofs branch from 9fedd82 to bc4a532 Oct 10, 2018

apoelstra added 17 commits Apr 3, 2018

add chacha20 function

4642c38

generator: add constant G and H generators

c70d4bf

split Pedersen commitments out into their own module

2153239

commitment: allow setting the blinding factor generator for Pedersen …

1e8874e

…commitments We now use ecmult_const rather than ecmult_gen, which will slow down the generation of Pedersen commitments. However as far as I'm aware, this is never the bottleneck in proof generation.

bulletproofs: add module, full support for rangeproofs

7ec1d8a

bulletproofs: add rangeproof rewinding capability

cc06fdd

bulletproofs: add benchmark

92b917a

commitment and bulletproof: fix a bunch of typos and stuff (thanks Ti…

19ef4bb

…m Ruffing)

bulletproofs: extensively comment inner product proof, remove a coupl…

e1d690e

…e expired TODOs

bulletproofs: add `n_commits` to the hash of all rangeproof input data

7dd0d1b

add new modules to travis

26df649

rangeproof: reduce test iterations; add echo script to travis to prev…

Loading status checks…

376d4fa

…ent timeout

bulletproofs: add circuit support

aa6c5fd

bulletproofs: add a bunch of binary example circuits

c26bc86

bulletproofs: extend API tests to cover circuits, fix existing tests

159060d

bulletproofs: add binary circuit with a committed input, test it

f308664

bulletproofs: add benchmark

Loading status checks…

9c3ba0c

apoelstra force-pushed the apoelstra:bulletproofs branch from bc4a532 to 9c3ba0c Oct 10, 2018

apoelstra force-pushed the ElementsProject:secp256k1-zkp branch from e100037 to 53ad841 Dec 14, 2018

apoelstra force-pushed the ElementsProject:secp256k1-zkp branch from bcabca9 to 6f3b0c0 May 30, 2019

jonasnick reviewed Jan 23, 2020

View changes

tomtau pushed a commit to crypto-com/secp256k1-zkp that referenced this pull request Jul 9, 2020

Merge pull request ElementsProject#16 from apoelstra/compact-sig

e69fedb

add compact signature encoding

jonasnick force-pushed the ElementsProject:secp256k1-zkp branch from dc4181a to fabc8f7 Jul 24, 2020

apoelstra closed this Dec 3, 2020

ElementsProject / secp256k1-zkp

WIP: bulletproofs #16

WIP: bulletproofs #16

apoelstra commented Nov 27, 2017 •

edited

This comment has been minimized.

jonasnick commented Feb 2, 2018

apoelstra commented Feb 2, 2018

jonasnick commented Feb 2, 2018

This comment has been minimized.

This comment has been minimized.

benma commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 31, 2018

apoelstra commented Oct 10, 2018

jonasnick left a comment •

edited

This comment has been minimized.

apoelstra commented Dec 3, 2020

ElementsProject / secp256k1-zkp

WIP: bulletproofs #16

WIP: bulletproofs #16

Conversation

apoelstra commented Nov 27, 2017 • edited

This comment has been minimized.

apoelstra Jan 19, 2018 Author Member

jonasnick commented Feb 2, 2018

apoelstra commented Feb 2, 2018

jonasnick commented Feb 2, 2018

This comment has been minimized.

jonasnick Feb 2, 2018 Contributor

This comment has been minimized.

jonasnick Feb 2, 2018 Contributor

benma commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 13, 2018

apoelstra commented Mar 31, 2018

apoelstra commented Oct 10, 2018

jonasnick left a comment • edited

This comment has been minimized.

jonasnick Jan 23, 2020 Contributor

apoelstra commented Dec 3, 2020

apoelstra commented Nov 27, 2017 •

edited

apoelstra Jan 19, 2018
Author Member

jonasnick Feb 2, 2018
Contributor

jonasnick Feb 2, 2018
Contributor

jonasnick left a comment •

edited

jonasnick Jan 23, 2020
Contributor