Bp++: Rangeproof PR by sanket1729 · Pull Request #207 · BlockstreamResearch/secp256k1-zkp

sanket1729 · 2022-12-01T07:39:23Z

This second PR introduces Bulletproofs++ Rangeproof argument. Builds on top of #205 . The companion protocol is described here:
BP_PP_proofs.pdf
The companion rust code is available at https://github.com/sanket1729/rust-bulletproofs-pp

This includes the core protocol with some optimizations but does not include

Complex multiplication.
Early termination.
Stack space efficient prover/verifier.
An implementation using gej_add_gej
Another trick in BP++ to reduce the size of c_vec. This is a non-trivial one to prove, but IMO the benefits are not worth the complexity.

Benchmarks show 0.95 ms for verification and ~4 ms prover time for 64 bit rangeproofs

apoelstra · 2023-01-19T20:52:44Z

+#include "scalar.h"
+#include "bulletproofs_util.h"
+
+/* Initialize the transcript with a fix protocol string*/


In 83b18e2:

lol pls provide a comment explaining how to reproduce these values

Lol, yep. The commit history in this PR is messed up. I was not expecting such a quick review here. Updating the PR to have a cleaner history.

You can double-check via https://github.com/sanket1729/rust-bitcoin/tree/bp_comm_reproduce cargo test -- --nocapture

jonasnick · 2023-02-07T16:54:51Z

PR #216 contains two commits that fix compilation and tests.

jonasnick · 2023-02-10T18:40:59Z

+    q_inv_pows = (secp256k1_scalar*)secp256k1_scratch_alloc(&ctx->error_callback, scratch, g_offset * sizeof(secp256k1_scalar));
+    g_vec_pub_deltas = (secp256k1_scalar*)secp256k1_scratch_alloc(&ctx->error_callback, scratch, g_offset * sizeof(secp256k1_scalar));
+
+    if ( q_pows == NULL || q_inv_pows == NULL ) {


Suggested change

if ( q_pows == NULL || q_inv_pows == NULL ) {

if ( q_pows == NULL || q_inv_pows == NULL || g_vec_pub_deltas == NULL) {

This reverts commit 860360e.

We can supply additional generators

- The first two bytes can be anything. - Also put the correct index for R_tmp

Liam had previsouly pointed that this should also commit to the generators. Tim mentioned that generators should be exposed in API at all. Porbably a good time to think through these issues

This commit also updates norm argument to use asset_gen instead of G for storing the inner product. This is an artifact of how CTs are used in elements/liquid today.

For compatibility with exisiting Pedersen commitments data structures, it is necessary to have commitments be of the G_a*v + G*gamma where G_a is asset gen and gamma is blinding factors. However, in BP++ design, the blinding values are along H_vec. In order make these compatible with BP++, we make h0 = G Also updates a few test cases to start from |H| = 8.

creation API

Commit to digits and multiplicities

Commit to reciprocals of digits as 1/(e + d_i)

Commit to S. Compute l's adaptive to create a zero polynomial

Run the run norm proof argument on the computed C

Combines all four rounds

jonasnick

See #220 for discussion on the generators API.

jonasnick · 2023-08-03T11:45:40Z

+ *  Args:      ctx: pointer to a context object
+ *         scratch: pointer to a scratch space
+ *            gens: pointer to the generator set to use, which must have exactly
+ *                 `n = max(num_digits, base) + 7` generators, where num_digits is the number.


"num_digits is the number." -> "num_digits is floor(log_base(value)) + 1?

jonasnick · 2023-08-07T19:45:37Z

I think you already did these changes, but, for reference, I made a checklist for rebasing #266.

HalosGhost · 2023-08-17T20:18:40Z

+/** Verifies an Bulletproofs++ rangeproof. Returns 1 on success, 0 on failure.
+ *  Args:      ctx: pointer to a context object
+ *         scratch: pointer to a scratch space
+ *            gens: pointer to the generator set to use, which must have at least 2*n_bits generators


bench_bppp uses 24 generators for both proving/verification; it looks like this should also be updated to reflect floor(log_base(value)) + 1.

dr-orlovsky · 2024-02-17T09:04:36Z

Is there anything which has to be done to get this merged?

I mean I am trying to estimate when we may have BPP rangeproofs in secp256k-zkp

jonasnick · 2024-02-19T09:49:19Z

Is there anything which has to be done to get this merged?

@dr-orlovsky Yes, this needs a lot more review and polishing. As far as I know, no one is working on this right now.

dr-orlovsky · 2024-02-19T18:46:14Z

Thank you for providing the update! So I assume it sounds more like ~year(s) and certainly not weeks/month

tevador · 2024-05-24T19:19:12Z

+    g_len = num_digits > base ? num_digits : base;
+    h_len = 8;
+    n_rounds = secp256k1_bppp_log2(g_len > h_len ? g_len : h_len);
+    return 33 * 4 + 65*n_rounds + 64;


The Bulletproofs++ paper claims on page 4, in Table 1, that a 64-bit range proof consists of 10 group elements and 3 scalars. The calculation here counts 12 group elements and 2 scalars (since n_rounds is 4 with base 16). What is the explanation for this discrepancy?

@tevador, this does not implement all the optimizations with early terminations.

Searching for "early termination" in the paper gives nothing. Can you point me to the relevant section of the paper?

OK, I think I figured it out from the code. If you do just 3 rounds instead of 4, you'll end up with n_vec of length 2 and l_vec of length 1, which is actually more compact.

Indeed. In the paper, we stop the recursion already when len(l_vec) + len(n_vec) <= 6, see page 13.

I think it should be len(l_vec) + len(n_vec) < 6. After 2 rounds, we get len(l_vec) = 2 and len(n_vec) = 4, but the proof can still be reduced by 31 or 32 bytes by performing the 3rd round.

sanket1729 force-pushed the bpp_final branch 2 times, most recently from 36329d9 to b8009af Compare December 1, 2022 10:27

apoelstra mentioned this pull request Dec 14, 2022

Uncompressed Bulletproof Rangeproofs #108

Closed

apoelstra mentioned this pull request Jan 19, 2023

Bulletproofs++: Norm argument #205

Merged

apoelstra reviewed Jan 19, 2023

View reviewed changes

sanket1729 force-pushed the bpp_final branch 5 times, most recently from 0fb6aa7 to 1176e1e Compare January 21, 2023 23:41

This was referenced Jan 23, 2023

Use secp256k1-zkp for bulletproofs & Pedersen commitments RGB-WG/rgb-core#9

Closed

Bulletproofs epic RGB-WG/rgb-core#130

Closed

jonasnick mentioned this pull request Feb 7, 2023

WIP: bulletproofs: use one large ecmult_multi instead of two smaller ones #216

Draft

2 tasks

sanket1729 force-pushed the bpp_final branch 4 times, most recently from a14b562 to c0da897 Compare February 8, 2023 21:07

jonasnick reviewed Feb 10, 2023

View reviewed changes

sanket1729 force-pushed the bpp_final branch from c0da897 to e0c243f Compare February 14, 2023 06:16

sanket1729 force-pushed the bpp_final branch from e0c243f to 7f775a0 Compare May 27, 2023 00:03

sanket1729 force-pushed the bpp_final branch 4 times, most recently from ceae9dc to 4201276 Compare June 6, 2023 18:57

apoelstra mentioned this pull request Jun 7, 2023

[about homomorphic update pedersen commitments] #235

Closed

sanket1729 force-pushed the bpp_final branch from 4201276 to bc7b28a Compare July 27, 2023 21:48

sanket1729 added 3 commits August 1, 2023 14:55

Drop this commit later: DO NOT MERGE

005ffbf

Revert "scalar: Remove unused secp256k1_scalar_chacha20"

021df62

This reverts commit 860360e.

Remove bppp_generators parse and serialize APIs

2e2c3cd

sanket1729 and others added 9 commits August 1, 2023 16:24

Relax generator len requirements to be exact n_len + l_len

3350782

We can supply additional generators

Fixup broken test for bppp_parse_one_of_points

8db2c3a

- The first two bytes can be anything. - Also put the correct index for R_tmp

Prepare of bulletproofs++ rangeproof implementation

5ec0f4a

Add initial commitment data function for rangeproofs

afc5291

Liam had previsouly pointed that this should also commit to the generators. Tim mentioned that generators should be exposed in API at all. Porbably a good time to think through these issues

Use asset generator base point instead of G.

79faa0c

This commit also updates norm argument to use asset_gen instead of G for storing the inner product. This is an artifact of how CTs are used in elements/liquid today.

Comment out one test case. This fails because of hacky serialization and

09665c8

creation API

make one ecmult_multi out of two

1cb5b94

Fixup h0 serializtion etc

cf08bd5

sanket1729 force-pushed the bpp_final branch from bc7b28a to 8afcd4b Compare August 1, 2023 23:24

sanket1729 added 10 commits August 1, 2023 17:36

Add BP++ round 1

15cee83

Commit to digits and multiplicities

BP++ prover round 2

5a1d01c

Commit to reciprocals of digits as 1/(e + d_i)

BP++ prover round 3

5b1017f

Commit to S. Compute l's adaptive to create a zero polynomial

Prover round 4: Norm proof argument

309dcbe

Run the run norm proof argument on the computed C

Add BP++ prover

0798cdc

Combines all four rounds

Add BP++ verifier

bcf6943

Expose BP++ Apis

2d31ff7

Add rangeproof unit tests

34d9d81

Add benchmarks

3353799

Fixup: test CI

2c5084e

sanket1729 force-pushed the bpp_final branch from 39214d7 to 2c5084e Compare August 2, 2023 00:37

jonasnick reviewed Aug 3, 2023

View reviewed changes

HalosGhost reviewed Aug 17, 2023

View reviewed changes

tevador reviewed May 24, 2024

View reviewed changes

HalosGhost mentioned this pull request May 30, 2024

Enable supply auditing by storing cryptographic commitments mit-dci/opencbdc-tx#101

Open

	if ( q_pows == NULL \|\| q_inv_pows == NULL ) {
	if ( q_pows == NULL \|\| q_inv_pows == NULL \|\| g_vec_pub_deltas == NULL) {

Conversation

sanket1729 commented Dec 1, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sanket1729 Jan 20, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonasnick commented Feb 7, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonasnick left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jonasnick commented Aug 7, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dr-orlovsky commented Feb 17, 2024

Uh oh!

jonasnick commented Feb 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dr-orlovsky commented Feb 19, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

real-or-random Jun 10, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

sanket1729 commented Dec 1, 2022 •

edited

Loading

sanket1729 Jan 20, 2023 •

edited

Loading

jonasnick commented Feb 19, 2024 •

edited

Loading

real-or-random Jun 10, 2024 •

edited

Loading