u128 and Scalar

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Entries are listed in reverse chronological order.
 
+## 3.0.0
+
+* Update `curve25519-dalek`, `sha3`, `digest` and `merlin` versions.
+* Add `scalar_range_proof` feature, which allow `RangeProof` to be used with `Scalar`.
+* Allow range proof with bitsize n = 128.
+* Use `u128` instead of `u64` in range proof.
+
 ## 2.0.0
 
 * Switch from `failure` to `std`-compatible errors via `thiserror`.

Cargo.toml

@@ -5,7 +5,7 @@ name = "bulletproofs"
 # - update html_root_url
 # - ensure yoloproofs was disabled in an atomic (revertable) commit
 # - update CHANGELOG
-version = "2.0.0"
+version = "3.0.0"
 authors = ["Cathie Yun <[email protected]>", 
  "Henry de Valence <[email protected]>",
  "Oleg Andreev <[email protected]>"]
@@ -15,20 +15,20 @@ repository = "https://github.com/dalek-cryptography/bulletproofs"
 categories = ["cryptography"]
 keywords = ["cryptography", "crypto", "ristretto", "zero-knowledge", "bulletproofs"]
 description = "A pure-Rust implementation of Bulletproofs using Ristretto"
-edition = "2018"
+edition = "2021"
 
 [dependencies]
-curve25519-dalek = { version = "2", default-features = false, features = ["u64_backend", "nightly", "serde", "alloc"] }
+curve25519-dalek = { version = "3.2.0", default-features = false, features = ["u64_backend", "nightly", "serde", "alloc"] }
 subtle = { version = "2", default-features = false }
-sha3 = { version = "0.8", default-features = false }
-digest = { version = "0.8", default-features = false }
+sha3 = { version = "0.9", default-features = false }
+digest = { version = "0.9", default-features = false }
 rand_core = { version = "0.5", default-features = false, features = ["alloc"] }
 rand = { version = "0.7", default-features = false, optional = true }
 byteorder = { version = "1", default-features = false }
 serde = { version = "1", default-features = false, features = ["alloc"] }
 serde_derive = { version = "1", default-features = false }
 thiserror = { version = "1", optional = true }
-merlin = { version = "2", default-features = false }
+merlin = { version = "3", default-features = false }
 clear_on_drop = { version = "0.2", default-features = false, features = ["nightly"] }
 
 [dev-dependencies]
@@ -42,10 +42,15 @@ default = ["std", "avx2_backend"]
 avx2_backend = ["curve25519-dalek/avx2_backend"]
 # yoloproofs = []
 std = ["rand", "rand/std", "thiserror"]
+scalar_range_proof = []
 
 [[test]]
 name = "range_proof"
 
+[[test]]
+name = "scalar_range_proof"
+required-features = ["scalar_range_proof"]
+
 [[test]]
 name = "r1cs"
 required-features = ["yoloproofs"]
@@ -67,3 +72,7 @@ required-features = ["yoloproofs"]
 name = "linear_proof"
 harness = false
 
+[[bench]]
+name = "scalar_range_proof"
+harness = false
+required-features = ["scalar_range_proof"]

README.md

@@ -112,12 +112,15 @@ The following example shows how to create and verify a 32-bit rangeproof.
 // independently of the Bulletproofs generators.
 let pc_gens = PedersenGens::default();
 
-// Generators for Bulletproofs, valid for proofs up to bitsize 64
+// Generators for Bulletproofs, valid for proofs up to bitsize 128
 // and aggregation size up to 1.
-let bp_gens = BulletproofGens::new(64, 1);
+let bp_gens = BulletproofGens::new(128, 1);
 
 // A secret value we want to prove lies in the range [0, 2^32)
-let secret_value = 1037578891u64;
+# #[cfg(not(feature = "scalar_range_proof"))]
+let secret_value = 1037578891u128;
+# #[cfg(feature = "scalar_range_proof")]
+# let secret_value = &Scalar::from(1037578891u128);
 
 // The API takes a blinding factor for the commitment.
 let blinding = Scalar::random(&mut thread_rng());

benches/range_proof.rs

@@ -16,7 +16,10 @@ use bulletproofs::{BulletproofGens, PedersenGens};
 static AGGREGATION_SIZES: [usize; 6] = [1, 2, 4, 8, 16, 32];
 
 fn create_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
- let label = format!("Aggregated {}-bit rangeproof creation", n);
+ #[cfg(not(feature = "scalar_range_proof"))]
+ let label = format!("Aggregated {}-bit rangeproof verification", n);
+ #[cfg(feature = "scalar_range_proof")]
+ let label = format!("Aggregated {}-bit rangeproof verification using Scalar", n);
 
  c.bench_function_over_inputs(
  &label,
@@ -25,8 +28,13 @@ fn create_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
  let bp_gens = BulletproofGens::new(n, m);
  let mut rng = rand::thread_rng();
 
- let (min, max) = (0u64, ((1u128 << n) - 1) as u64);
- let values: Vec<u64> = (0..m).map(|_| rng.gen_range(min, max)).collect();
+ let (min, max) = (0u128, u128::MAX >> (u128::BITS as usize - n));
+
+ #[cfg(not(feature = "scalar_range_proof"))]
+ let values: Vec<u128> = (0..m).map(|_| rng.gen_range(min, max)).collect();
+ #[cfg(feature = "scalar_range_proof")]
+ let values: Vec<Scalar> = (0..m).map(|_| rng.gen_range(min, max).into()).collect();
+
  let blindings: Vec<Scalar> = (0..m).map(|_| Scalar::random(&mut rng)).collect();
 
  b.iter(|| {
@@ -63,8 +71,15 @@ fn create_aggregated_rangeproof_n_64(c: &mut Criterion) {
  create_aggregated_rangeproof_helper(64, c);
 }
 
+fn create_aggregated_rangeproof_n_128(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(128, c);
+}
+
 fn verify_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
+ #[cfg(not(feature = "scalar_range_proof"))]
  let label = format!("Aggregated {}-bit rangeproof verification", n);
+ #[cfg(feature = "scalar_range_proof")]
+ let label = format!("Aggregated {}-bit rangeproof verification using Scalar", n);
 
  c.bench_function_over_inputs(
  &label,
@@ -73,8 +88,13 @@ fn verify_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
  let bp_gens = BulletproofGens::new(n, m);
  let mut rng = rand::thread_rng();
 
- let (min, max) = (0u64, ((1u128 << n) - 1) as u64);
- let values: Vec<u64> = (0..m).map(|_| rng.gen_range(min, max)).collect();
+ let (min, max) = (0u128, u128::MAX >> (u128::BITS as usize - n));
+
+ #[cfg(not(feature = "scalar_range_proof"))]
+ let values: Vec<u128> = (0..m).map(|_| rng.gen_range(min, max)).collect();
+ #[cfg(feature = "scalar_range_proof")]
+ let values: Vec<Scalar> = (0..m).map(|_| rng.gen_range(min, max).into()).collect();
+
  let blindings: Vec<Scalar> = (0..m).map(|_| Scalar::random(&mut rng)).collect();
 
  let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
@@ -115,6 +135,10 @@ fn verify_aggregated_rangeproof_n_64(c: &mut Criterion) {
  verify_aggregated_rangeproof_helper(64, c);
 }
 
+fn verify_aggregated_rangeproof_n_128(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(128, c);
+}
+
 criterion_group! {
  name = create_rp;
  config = Criterion::default().sample_size(10);
@@ -123,6 +147,7 @@ criterion_group! {
  create_aggregated_rangeproof_n_16,
  create_aggregated_rangeproof_n_32,
  create_aggregated_rangeproof_n_64,
+ create_aggregated_rangeproof_n_128,
 }
 
 criterion_group! {
@@ -133,6 +158,7 @@ criterion_group! {
  verify_aggregated_rangeproof_n_16,
  verify_aggregated_rangeproof_n_32,
  verify_aggregated_rangeproof_n_64,
+ verify_aggregated_rangeproof_n_128,
 }
 
 criterion_main!(create_rp, verify_rp);

benches/scalar_range_proof.rs

@@ -0,0 +1,148 @@
+#![allow(non_snake_case)]
+#[macro_use]
+extern crate criterion;
+use criterion::Criterion;
+
+use rand;
+use rand::Rng;
+
+use curve25519_dalek::scalar::Scalar;
+
+use merlin::Transcript;
+
+use bulletproofs::RangeProof;
+use bulletproofs::{BulletproofGens, PedersenGens};
+
+static AGGREGATION_SIZES: [usize; 6] = [1, 2, 4, 8, 16, 32];
+
+fn create_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
+ let label = format!("Aggregated {}-bit rangeproof verification using Scalar", n);
+
+ c.bench_function_over_inputs(
+ &label,
+ move |b, &&m| {
+ let pc_gens = PedersenGens::default();
+ let bp_gens = BulletproofGens::new(n, m);
+ let mut rng = rand::thread_rng();
+
+ let (min, max) = (0u128, u128::MAX >> (u128::BITS as usize - n));
+ let values: Vec<Scalar> = (0..m).map(|_| rng.gen_range(min, max).into()).collect();
+ let blindings: Vec<Scalar> = (0..m).map(|_| Scalar::random(&mut rng)).collect();
+
+ b.iter(|| {
+ // Each proof creation requires a clean transcript.
+ let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
+
+ RangeProof::prove_multiple(
+ &bp_gens,
+ &pc_gens,
+ &mut transcript,
+ &values,
+ &blindings,
+ n,
+ )
+ })
+ },
+ &AGGREGATION_SIZES,
+ );
+}
+
+fn create_aggregated_rangeproof_n_8(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(8, c);
+}
+
+fn create_aggregated_rangeproof_n_16(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(16, c);
+}
+
+fn create_aggregated_rangeproof_n_32(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(32, c);
+}
+
+fn create_aggregated_rangeproof_n_64(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(64, c);
+}
+
+fn create_aggregated_rangeproof_n_128(c: &mut Criterion) {
+ create_aggregated_rangeproof_helper(128, c);
+}
+
+fn verify_aggregated_rangeproof_helper(n: usize, c: &mut Criterion) {
+ let label = format!("Aggregated {}-bit rangeproof verification using Scalar", n);
+
+ c.bench_function_over_inputs(
+ &label,
+ move |b, &&m| {
+ let pc_gens = PedersenGens::default();
+ let bp_gens = BulletproofGens::new(n, m);
+ let mut rng = rand::thread_rng();
+
+ let (min, max) = (0u128, u128::MAX >> (u128::BITS as usize - n));
+ let values: Vec<Scalar> = (0..m).map(|_| rng.gen_range(min, max).into()).collect();
+ let blindings: Vec<Scalar> = (0..m).map(|_| Scalar::random(&mut rng)).collect();
+
+ let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
+ let (proof, value_commitments) = RangeProof::prove_multiple(
+ &bp_gens,
+ &pc_gens,
+ &mut transcript,
+ &values,
+ &blindings,
+ n,
+ )
+ .unwrap();
+
+ b.iter(|| {
+ // Each proof creation requires a clean transcript.
+ let mut transcript = Transcript::new(b"AggregateRangeProofBenchmark");
+
+ proof.verify_multiple(&bp_gens, &pc_gens, &mut transcript, &value_commitments, n)
+ });
+ },
+ &AGGREGATION_SIZES,
+ );
+}
+
+fn verify_aggregated_rangeproof_n_8(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(8, c);
+}
+
+fn verify_aggregated_rangeproof_n_16(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(16, c);
+}
+
+fn verify_aggregated_rangeproof_n_32(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(32, c);
+}
+
+fn verify_aggregated_rangeproof_n_64(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(64, c);
+}
+
+fn verify_aggregated_rangeproof_n_128(c: &mut Criterion) {
+ verify_aggregated_rangeproof_helper(128, c);
+}
+
+criterion_group! {
+ name = create_rp;
+ config = Criterion::default().sample_size(10);
+ targets =
+ create_aggregated_rangeproof_n_8,
+ create_aggregated_rangeproof_n_16,
+ create_aggregated_rangeproof_n_32,
+ create_aggregated_rangeproof_n_64,
+ create_aggregated_rangeproof_n_128,
+}
+
+criterion_group! {
+ name = verify_rp;
+ config = Criterion::default();
+ targets =
+ verify_aggregated_rangeproof_n_8,
+ verify_aggregated_rangeproof_n_16,
+ verify_aggregated_rangeproof_n_32,
+ verify_aggregated_rangeproof_n_64,
+ verify_aggregated_rangeproof_n_128,
+}
+
+criterion_main!(create_rp, verify_rp);

rust-toolchain

@@ -1 +1 @@
-nightly-2019-07-31
+nightly-2023-01-01

src/errors.rs

@@ -21,8 +21,11 @@ pub enum ProofError {
  #[cfg_attr(feature = "std", error("Wrong number of blinding factors supplied."))]
  WrongNumBlindingFactors,
  /// This error occurs when attempting to create a proof with
- /// bitsize other than \\(8\\), \\(16\\), \\(32\\), or \\(64\\).
- #[cfg_attr(feature = "std", error("Invalid bitsize, must have n = 8,16,32,64."))]
+ /// bitsize other than \\(8\\), \\(16\\), \\(32\\), \\(64\\) or \\(128\\).
+ #[cfg_attr(
+ feature = "std",
+ error("Invalid bitsize, must have n = 8,16,32,64,128.")
+ )]
  InvalidBitsize,
  /// This error occurs when attempting to create an aggregated
  /// proof with non-power-of-two aggregation size.
@@ -73,8 +76,11 @@ pub enum MPCError {
  #[cfg_attr(feature = "std", error("Dealer gave a malicious challenge value."))]
  MaliciousDealer,
  /// This error occurs when attempting to create a proof with
- /// bitsize other than \\(8\\), \\(16\\), \\(32\\), or \\(64\\).
- #[cfg_attr(feature = "std", error("Invalid bitsize, must have n = 8,16,32,64"))]
+ /// bitsize other than \\(8\\), \\(16\\), \\(32\\), \\(64\\) or \\(128\\).
+ #[cfg_attr(
+ feature = "std",
+ error("Invalid bitsize, must have n = 8,16,32,64,128")
+ )]
  InvalidBitsize,
  /// This error occurs when attempting to create an aggregated
  /// proof with non-power-of-two aggregation size.

src/generators.rs

@@ -12,7 +12,7 @@ use curve25519_dalek::constants::RISTRETTO_BASEPOINT_POINT;
 use curve25519_dalek::ristretto::RistrettoPoint;
 use curve25519_dalek::scalar::Scalar;
 use curve25519_dalek::traits::MultiscalarMul;
-use digest::{ExtendableOutput, Input, XofReader};
+use digest::{ExtendableOutput, Update, XofReader};
 use sha3::{Sha3XofReader, Sha3_512, Shake256};
 
 /// Represents a pair of base points for Pedersen commitments.
@@ -63,11 +63,11 @@ impl GeneratorsChain {
  /// Creates a chain of generators, determined by the hash of `label`.
  fn new(label: &[u8]) -> Self {
  let mut shake = Shake256::default();
- shake.input(b"GeneratorsChain");
- shake.input(label);
+ shake.update(b"GeneratorsChain");
+ shake.update(label);
 
  GeneratorsChain {
- reader: shake.xof_result(),
+ reader: shake.finalize_xof(),
  }
  }
 
@@ -169,7 +169,7 @@ impl BulletproofGens {
  /// slice of vectors G and H for the j-th range proof.
  pub fn share(&self, j: usize) -> BulletproofGensShare<'_> {
  BulletproofGensShare {
- gens: &self,
+ gens: self,
  share: j,
  }
  }