Compute the commitment C and run the norm arg on it C = S + t*M + t^2*D + t^3*R + 2t^5*V + P P = + g_offset*G
(
&self,
num_bits: u16,
V: &[G],
setup_params: &SetupParams<G>,
transcript: &mut impl Transcript,
)
| 771 | /// C = S + t*M + t^2*D + t^3*R + 2t^5*V + P |
| 772 | /// P = <g_vec_pub_offsets, G_vec> + g_offset*G |
| 773 | pub fn verify( |
| 774 | &self, |
| 775 | num_bits: u16, |
| 776 | V: &[G], |
| 777 | setup_params: &SetupParams<G>, |
| 778 | transcript: &mut impl Transcript, |
| 779 | ) -> Result<(), BulletproofsPlusPlusError> { |
| 780 | let base_bits = util::base_bits(self.base); |
| 781 | if num_bits < base_bits { |
| 782 | return Err(BulletproofsPlusPlusError::ValueIncompatibleWithBase(format!("number of bits in value={} which should not be less than number of bits in base={}", num_bits, self.base))); |
| 783 | } |
| 784 | // number of digits for 1 proof |
| 785 | let num_digits_per_proof = num_bits / base_bits; |
| 786 | let num_proofs = V.len(); |
| 787 | let total_num_digits = num_digits_per_proof as usize * num_proofs; |
| 788 | let e = self.r1_comm.challenge(self.base, num_bits, V, transcript); |
| 789 | let (x, y, r, q, lambda, delta) = self.r2_comm.challenges(transcript); |
| 790 | let t = self.r3_comm.challenge(transcript); |
| 791 | let t_pows = TPowers::new(t, setup_params.H_vec.len() as u32); |
| 792 | |
| 793 | let c_vec = create_c_vec(y, &t_pows); |
| 794 | let (t_inv, t_sqr, t_cube) = ( |
| 795 | t_pows.nth_power(-1), |
| 796 | t_pows.nth_power(2), |
| 797 | t_pows.nth_power(3), |
| 798 | ); |
| 799 | |
| 800 | // q_pows = (q, q^2, q^3, ..., q^{g_vec.len()}) |
| 801 | let q_pows = powers_starting_from(q.clone(), &q, setup_params.G_vec.len() as u32); |
| 802 | |
| 803 | // q_inv_pows = (q^-1, q^-2, q^-3, ..., q^{-g_vec.len()}) |
| 804 | let mut q_inv_pows = q_pows.clone(); |
| 805 | batch_inversion(&mut q_inv_pows); |
| 806 | |
| 807 | let lambda_powers = powers(&lambda, num_proofs as u32); |
| 808 | let alpha_d = alpha_d_given_lambda_powers(self.base, num_digits_per_proof, &lambda_powers); |
| 809 | let alpha_d_q_inv_pow = hadamard_product(&alpha_d, &q_inv_pows); |
| 810 | |
| 811 | let alpha_r2 = alpha_r2(total_num_digits, e); |
| 812 | let alpha_r = alpha_r(total_num_digits, x, delta); |
| 813 | let alpha_r_q_inv_pows = alpha_r_q_inv_pow_given_alpha_r(&alpha_r, &alpha_r2, &q_inv_pows); |
| 814 | |
| 815 | // Compute the commitment to the public values |
| 816 | let g_offset = self.g_offset( |
| 817 | &alpha_r, |
| 818 | &alpha_r2, |
| 819 | t_cube, |
| 820 | &q_pows, |
| 821 | &alpha_d_q_inv_pow, |
| 822 | &alpha_d, |
| 823 | total_num_digits, |
| 824 | ); |
| 825 | let mut g_vec_pub_offsets = self.g_vec_pub_offsets( |
| 826 | e, |
| 827 | x, |
| 828 | &alpha_r_q_inv_pows, |
| 829 | &t_pows, |
| 830 | &q_inv_pows, |