Get share given by party with id `id` in phase 1.

Get the public output and input signals of the circuit excluding the first signal "1". The returned vector contains the public output signals, followe

Move the file cursor to the place where the subgroup order is written in little-endian order. The order is prime.

Get the response from post-challenge phase of the Schnorr protocol for the given message index `msg_idx`. Used when comparing message equality

Get the response from post-challenge phase of the Schnorr protocol for the given message index `msg_idx`. Used when comparing message equality

Get the response from post-challenge phase of the Schnorr protocol for the given message index `msg_idx`. Used when comparing message equality

Get SAVER randomness, ciphertext and proof to reuse for the given statement id

Return number of signals for an input signal. For signals that are arrays, it returns the length of the array otherwise returns 1.

Returns a vector of tuples where each tuple is a pair of commitments as (`(v_i - min_i)`, `(max_i - v_i)`)

Get the Circom version used to generate the WASM module

Move the cursor to the `i`th witness in the WASM module.

Return number of wires in the circuit

gipa_tipp_mipp performs the recursion of the GIPA protocol for TIPP and MIPP. It returns a proof containing all intermediate committed values, as well

gipa_tipp_mipp performs the recursion of the GIPA protocol for TIPP and MIPP. It returns a proof containing all intermediate committed values, as well

gipa_verify_tipp_mipp recurse on the proof and statement and produces the final values to be checked by TIPP and MIPP verifier, namely, for TIPP for e

gipa_verify_tipp_mipp recurse on the proof and statement and produces the final values to be checked by TIPP and MIPP verifier, namely, for TIPP for e

Runs the LegoGroth16 protocol to prove that the message is bounded and initialize a Schnorr proof of knowledge protocol to prove knowledge of the comm

Initialize state

Insert value `v` in the column index `c` at row index `r`

Checks that the elliptic curve point in the signature is non-zero

Return the Lagrange basis polynomial at x = 0 given the `x` coordinates. `(x_coords[0]) * (x_coords[1]) * ... / ((x_coords[0] - i) * (x_coords[1] - i)

Return the Lagrange basis polynomial at x = 0 for each of the given `x` coordinates. Faster than doing multiple calls to `lagrange_basis_at_0`

Produces an iterator of little endian bytes of each element contained in the range `counter_range`

This is an implementation of MiMC, specifically a variant named `LongsightF322p3` for BLS12-377. See http://eprint.iacr.org/2016/492 for more informat

`G::Group::msm_bigint(left, right)`

multiply a vector polynomial `c` whose coefficients are constants, i.e. coefficient vectors have only 1 coefficient

fetches 64 bits of randomness

Number of proofs to aggregate

Return nodes on a path from leaf level till root level - 1 (excluding root node as root node can create the whole tree) that allow reconstructing all

Optimal base as suggested by the CCS and CLS paper as `log_2(range)/log_2(log_2(range))` where `range = max - min` A more optimal base can be calculat

Performs some high level checks on the length of vectors and others to make sure all items in the proofs are consistent with each other.

The degree of the polynomial whose coefficients were committed

Prepare `self` for use in proof verification.

Prepare proof inputs for use with [`verify_proof`], wrt the prepared verification key `pvk` and instance public inputs.

Proves a TIPP relation between A and B as well as a MIPP relation with C and r. Commitment keys must be of size of A, B and C. In the context of Groth

Proves a TIPP relation between A and B as well as a MIPP relation with C and r. Commitment keys must be of size of A, B and C. In the context of Groth

Randomize the Groth16 proof as per algorithm 2 of the paper. Can alternatively use `rerandomize_proof` from `ark_groth16`

Read the wire to label map. The labels not part of constraints because they were optimized out are not part of this map.

Process received commitments to the shares from another party and store it

Removing a batch of members from the accumulator. Reads and writes to state. Described in section 3 of the paper

Removes a batch of elements from the accumulator. Returns the new value of the accumulator

Called when got >= `threshold` complaints for `participant_id` and disqualifying a participant

Create responses for each witness (discrete log) as `response[i] = self.blindings[i] + (witnesses[i] * challenge)`

Get the response from post-challenge phase of the Schnorr protocol for the given message index `msg_idx`. Used when comparing message equality.

Returns underlying right elements.

Round 1: Commit to the base representation of the value and multiplicities # The digits commitment: D The prover first computes the base representat

Prover Round 2: Prover has committed to d_vec and m_vec in the previous round. Received challenge e. # The reciprocal commitment: R The prover compu

Prover Round 3: Prover has committed to r_vec in the previous round. Received challenge (x, y, q, lambda, delta). Already has e from round 1 lambda is

Round 4: Run the norm argument on the obtained challenge t. If we have sent the correct commitments, we only need to evaluate the poly w_vec at t and

After verifying the signature request, signer creates a signature using the request

Solve discrete log using brute force. `max` is the maximum value of the discrete log and this returns `x` such that `1 <= x <= max` and `base * x = ta

Splits blinded message into the message and blinding, returns `None` for the revealed message.

Modified from https://mischasan.wordpress.com/2011/10/03/the-full-sse2-bit-matrix-transpose-routine/ with inner most loops changed to _mm_set_epi8 and