Compute new accumulated value after addition. Described in section 2 of the paper

Compute new accumulated value after batch addition. Described in section 3 of the paper

Compute new accumulated value after batch additions and removals. Described in section 3 of the paper

Compute new accumulated value after removal. Described in section 2 of the paper

Common code for removing a single member from both accumulators. Reads and writes to state. Described in section 2 of the paper

Common code for removing a batch of members from both accumulators. Reads and writes to state. Described in section 3 of the paper

Called by a participant when it creates a share for itself

Generate challenge from transcript by adding `k1_com`, `k2_com` and ensuring that the challenge is of `CHALLENGE_BIT_SIZE` bits max.

Update an accumulator with a batch of updates, update existing witnesses of given elements and check that new witnesses are valid

Update an accumulator with a batch of updates, update existing witnesses of given elements and check that new witnesses are valid

Same as `commit_decomposed` but takes `[1, base, base^2, ..., base^{n-1}]`

Returns `v*g + <g_vec, n> + <h_vec, l>`

Use the shares received from all parties to compute the joint randomness

Compute new accumulated value after batch additions and removals

Create Pedersen commitment as `C = v*G + gamma*H_vec[0]`

ConvertSK from the paper.

Create the new witnesses and commit to them in a single commitment from the given witnesses and their individual commitments

Create polynomial referred to p(X) in the paper. p(0) = 1 and p(X) = 0 for all X in given vector `x`, thus its a polynomial of degree `x.len()`. From

Same as `deal_random_secret` above but accepts the secret to share

Decrypt the given ciphertext and return the message and a "commitment" to randomness to help in verifying the decryption without knowledge of secret k

Called by a participant when it has received shares from all participants. Computes the final share of the distributed secret

Returns what the paper calls l and calculated as `ceil(log_u(range+1))`. Here we assume that `base - 1` divides `range`.

Returns what the paper calls `G_i`, `range` is called `H` and `num` is called `l` in the paper. Calculates as per Theorem 2 in the paper

Finish phase 2 to get the user secret key share to be sent to the user.

Generate a partial proof, i.e. don't generate responses for message indices in `skip_responses_for` as these will be generated by some other protocol.

Generate a partial proof, i.e. don't generate responses for message indices in `skip_responses_for` as these will be generated by some other protocol.

Call this on the accumulator before update

Pre-requisites of applying sumset protocol Returns number of digits, sumset boundaries (G), randomness multiple and digits of the adapted value.

Returns true if it has got shares from all other participants that sent commitments.

A witness equality should have at least 2 witness references.

Returns underlying left elements.

Maximum elements the accumulator should hold

Multiply given polynomials together

Pad given homomorphisms such that all have the same size after padding

Create a polynomial with given points in `updates` as: `(updates[0]-x) * (updates[1]-x) * (updates[2] - x)...(updates[last] - x)`

Basic validations before signature verification like there is at-least 1 message, the number of messages are supported by params, signature is non-zer

Randomize the set commitment and the corresponding opening

Process received commitments for joint randomness and zero sharing protocol

Skips up to `n` elements from the iterator using supplied random generator.

Solve discrete log using Baby Step Giant Step with worse worst-case performance but better average case performance as described in section 2 of <http

Create a new sub-proof that can be verified by someone with the secret key. This doesn't need to be created if `self.proof_of_validity` is set.

Remove the user's public key from the signature making it orphan

Transpose a bit-matrix by dividing into submatrices, each of 8x8 bits, transposing the submatrix and placing the submatrices into their appropriate po

Update witness after removal of an element from accumulator. The removed element is expected to be passed as members of the non-adaptive accumulator

Verifies underlying proof of knowledge using supplied arguments. `unique_sorted_revealed_indices` must produce sorted unique indices, otherwise, an er

Verify the proof for `0 <= value < max` where `commitment` is a Pedersen commitment to `value`

Verify the proof for `min <= value < max` where `commitment` is a Pedersen commitment to `value`

Verify the proof for `0 <= value < max` where `commitment` is a Pedersen commitment to `value`

Verify the proof for `min <= value < max` where `commitment` is a Pedersen commitment to `value`

Verify the proof using secret key