Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
/**********************************************************************
* Copyright ( c ) 2015 Gregory Maxwell *
* Distributed under the MIT software license , see the accompanying *
* file COPYING or http : //www.opensource.org/licenses/mit-license.php.*
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
# ifndef SECP256K1_MODULE_RANGEPROOF_TESTS
# define SECP256K1_MODULE_RANGEPROOF_TESTS
2016-07-05 15:46:07 +00:00
# include <string.h>
2022-08-04 20:47:19 +00:00
# include "../../group.h"
# include "../../scalar.h"
# include "../../testrand.h"
# include "../../util.h"
2016-07-04 13:04:57 +00:00
2022-08-04 20:47:19 +00:00
# include "../../../include/secp256k1_rangeproof.h"
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
2022-01-04 12:57:57 +00:00
static void test_rangeproof_api ( const secp256k1_context * none , const secp256k1_context * sign , const secp256k1_context * vrfy , const secp256k1_context * both , const secp256k1_context * sttc , const int32_t * ecount ) {
2017-05-03 18:08:31 +00:00
unsigned char proof [ 5134 ] ;
unsigned char blind [ 32 ] ;
secp256k1_pedersen_commitment commit ;
2020-11-05 20:21:38 +00:00
uint64_t vmin = secp256k1_testrand32 ( ) ;
uint64_t val = vmin + secp256k1_testrand32 ( ) ;
2017-05-03 18:08:31 +00:00
size_t len = sizeof ( proof ) ;
/* we'll switch to dylan thomas for this one */
const unsigned char message [ 68 ] = " My tears are like the quiet drift / Of petals from some magic rose; " ;
size_t mlen = sizeof ( message ) ;
const unsigned char ext_commit [ 72 ] = " And all my grief flows from the rift / Of unremembered skies and snows. " ;
size_t ext_commit_len = sizeof ( ext_commit ) ;
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( blind ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , val , secp256k1_generator_h ) ) ;
2022-01-01 21:59:25 +00:00
CHECK ( secp256k1_rangeproof_sign ( none , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2021-09-15 22:03:06 +00:00
CHECK ( secp256k1_rangeproof_sign ( sign , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 1 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( secp256k1_rangeproof_sign ( vrfy , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( sttc , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 1 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , NULL , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 2 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , NULL , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 3 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , NULL , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 4 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , NULL , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 5 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , NULL , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 6 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , vmin - 1 , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 6 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , NULL , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 7 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , NULL , 0 , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 7 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , NULL , 0 , NULL , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 8 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ! = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 8 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , NULL , 0 , NULL , 0 , NULL ) = = 0 ) ;
CHECK ( * ecount = = 9 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_sign ( both , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , val , message , mlen , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
{
int exp ;
int mantissa ;
uint64_t min_value ;
uint64_t max_value ;
CHECK ( secp256k1_rangeproof_info ( none , & exp , & mantissa , & min_value , & max_value , proof , len ) ! = 0 ) ;
CHECK ( exp = = 0 ) ;
CHECK ( ( ( uint64_t ) 1 < < mantissa ) > val - vmin ) ;
CHECK ( ( ( uint64_t ) 1 < < ( mantissa - 1 ) ) < = val - vmin ) ;
CHECK ( min_value = = vmin ) ;
CHECK ( max_value > = val ) ;
CHECK ( secp256k1_rangeproof_info ( none , NULL , & mantissa , & min_value , & max_value , proof , len ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 10 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_info ( none , & exp , NULL , & min_value , & max_value , proof , len ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 11 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_info ( none , & exp , & mantissa , NULL , & max_value , proof , len ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 12 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_info ( none , & exp , & mantissa , & min_value , NULL , proof , len ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 13 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_info ( none , & exp , & mantissa , & min_value , & max_value , NULL , len ) = = 0 ) ;
CHECK ( * ecount = = 14 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_info ( none , & exp , & mantissa , & min_value , & max_value , proof , 0 ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 14 ) ;
2017-05-03 18:08:31 +00:00
}
{
uint64_t min_value ;
uint64_t max_value ;
2021-09-15 22:03:06 +00:00
CHECK ( secp256k1_rangeproof_verify ( none , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 1 ) ;
CHECK ( secp256k1_rangeproof_verify ( sign , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 1 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 14 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , NULL , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 15 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , NULL , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 16 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , NULL , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 17 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , NULL , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 18 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , proof , 0 , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 18 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , proof , len , NULL , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 19 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) = = 0 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( * ecount = = 19 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( secp256k1_rangeproof_verify ( vrfy , & min_value , & max_value , & commit , proof , len , NULL , 0 , NULL ) = = 0 ) ;
CHECK ( * ecount = = 20 ) ;
2017-05-03 18:08:31 +00:00
}
{
unsigned char blind_out [ 32 ] ;
unsigned char message_out [ 68 ] ;
uint64_t value_out ;
uint64_t min_value ;
uint64_t max_value ;
size_t message_len = sizeof ( message_out ) ;
2022-01-01 21:59:25 +00:00
CHECK ( secp256k1_rangeproof_rewind ( none , blind_out , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 20 ) ;
2021-09-15 22:03:06 +00:00
CHECK ( secp256k1_rangeproof_rewind ( sign , blind_out , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 1 ) ;
2022-01-01 21:59:25 +00:00
CHECK ( secp256k1_rangeproof_rewind ( vrfy , blind_out , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 20 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 20 ) ;
CHECK ( secp256k1_rangeproof_rewind ( sttc , blind_out , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
CHECK ( * ecount = = 21 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( min_value = = vmin ) ;
CHECK ( max_value > = val ) ;
CHECK ( value_out = = val ) ;
CHECK ( message_len = = sizeof ( message_out ) ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( message , message_out , sizeof ( message_out ) ) = = 0 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , NULL , & value_out , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 21 ) ; /* blindout may be NULL */
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , NULL , message_out , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 21 ) ; /* valueout may be NULL */
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , & message_len , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 22 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) ! = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 22 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , NULL , & min_value , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 23 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , NULL , & max_value , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 24 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , NULL , & commit , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 25 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , NULL , proof , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 26 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , NULL , len , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 27 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , proof , 0 , ext_commit , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 27 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , proof , len , NULL , ext_commit_len , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 28 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 28 ) ;
2017-05-03 18:08:31 +00:00
CHECK ( secp256k1_rangeproof_rewind ( both , blind_out , & value_out , NULL , 0 , commit . data , & min_value , & max_value , & commit , proof , len , NULL , 0 , NULL ) = = 0 ) ;
2022-01-04 12:57:57 +00:00
CHECK ( * ecount = = 29 ) ;
2017-05-03 18:08:31 +00:00
}
2022-08-13 00:37:20 +00:00
/* This constant is hardcoded in these tests and elsewhere, so we
* consider it to be part of the API and test it here . */
CHECK ( secp256k1_rangeproof_max_size ( none , 0 , 64 ) = = 5134 ) ;
CHECK ( secp256k1_rangeproof_max_size ( none , UINT64_MAX , 0 ) = = 5134 ) ;
2017-05-03 18:08:31 +00:00
}
static void test_api ( void ) {
secp256k1_context * none = secp256k1_context_create ( SECP256K1_CONTEXT_NONE ) ;
secp256k1_context * sign = secp256k1_context_create ( SECP256K1_CONTEXT_SIGN ) ;
secp256k1_context * vrfy = secp256k1_context_create ( SECP256K1_CONTEXT_VERIFY ) ;
secp256k1_context * both = secp256k1_context_create ( SECP256K1_CONTEXT_SIGN | SECP256K1_CONTEXT_VERIFY ) ;
2022-01-04 12:57:57 +00:00
secp256k1_context * sttc = secp256k1_context_clone ( secp256k1_context_no_precomp ) ;
2017-05-03 18:08:31 +00:00
int32_t ecount ;
int i ;
secp256k1_context_set_error_callback ( none , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_error_callback ( sign , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_error_callback ( vrfy , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_error_callback ( both , counting_illegal_callback_fn , & ecount ) ;
2022-01-04 12:57:57 +00:00
secp256k1_context_set_error_callback ( sttc , counting_illegal_callback_fn , & ecount ) ;
2017-05-03 18:08:31 +00:00
secp256k1_context_set_illegal_callback ( none , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_illegal_callback ( sign , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_illegal_callback ( vrfy , counting_illegal_callback_fn , & ecount ) ;
secp256k1_context_set_illegal_callback ( both , counting_illegal_callback_fn , & ecount ) ;
2022-01-04 12:57:57 +00:00
secp256k1_context_set_illegal_callback ( sttc , counting_illegal_callback_fn , & ecount ) ;
2017-05-03 18:08:31 +00:00
for ( i = 0 ; i < count ; i + + ) {
ecount = 0 ;
2022-01-04 12:57:57 +00:00
test_rangeproof_api ( none , sign , vrfy , both , sttc , & ecount ) ;
2017-05-03 18:08:31 +00:00
}
secp256k1_context_destroy ( none ) ;
secp256k1_context_destroy ( sign ) ;
secp256k1_context_destroy ( vrfy ) ;
secp256k1_context_destroy ( both ) ;
2022-01-04 12:57:57 +00:00
secp256k1_context_destroy ( sttc ) ;
2017-05-03 18:08:31 +00:00
}
2016-07-06 15:44:09 +00:00
static void test_borromean ( void ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
unsigned char e0 [ 32 ] ;
secp256k1_scalar s [ 64 ] ;
secp256k1_gej pubs [ 64 ] ;
secp256k1_scalar k [ 8 ] ;
secp256k1_scalar sec [ 8 ] ;
secp256k1_ge ge ;
secp256k1_scalar one ;
unsigned char m [ 32 ] ;
2016-07-04 13:04:57 +00:00
size_t rsizes [ 8 ] ;
size_t secidx [ 8 ] ;
size_t nrings ;
size_t i ;
size_t j ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
int c ;
2020-11-05 20:21:38 +00:00
secp256k1_testrand256_test ( m ) ;
nrings = 1 + ( secp256k1_testrand32 ( ) & 7 ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
c = 0 ;
secp256k1_scalar_set_int ( & one , 1 ) ;
2020-11-05 20:21:38 +00:00
if ( secp256k1_testrand32 ( ) & 1 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
secp256k1_scalar_negate ( & one , & one ) ;
}
for ( i = 0 ; i < nrings ; i + + ) {
2020-11-05 20:21:38 +00:00
rsizes [ i ] = 1 + ( secp256k1_testrand32 ( ) & 7 ) ;
secidx [ i ] = secp256k1_testrand32 ( ) % rsizes [ i ] ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
random_scalar_order ( & sec [ i ] ) ;
random_scalar_order ( & k [ i ] ) ;
2020-11-05 20:21:38 +00:00
if ( secp256k1_testrand32 ( ) & 7 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
sec [ i ] = one ;
}
2020-11-05 20:21:38 +00:00
if ( secp256k1_testrand32 ( ) & 7 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
k [ i ] = one ;
}
for ( j = 0 ; j < rsizes [ i ] ; j + + ) {
random_scalar_order ( & s [ c + j ] ) ;
2020-11-05 20:21:38 +00:00
if ( secp256k1_testrand32 ( ) & 7 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
s [ i ] = one ;
}
if ( j = = secidx [ i ] ) {
secp256k1_ecmult_gen ( & ctx - > ecmult_gen_ctx , & pubs [ c + j ] , & sec [ i ] ) ;
} else {
random_group_element_test ( & ge ) ;
random_group_element_jacobian_test ( & pubs [ c + j ] , & ge ) ;
}
}
c + = rsizes [ i ] ;
}
2021-09-15 22:03:06 +00:00
CHECK ( secp256k1_borromean_sign ( & ctx - > ecmult_gen_ctx , e0 , s , pubs , k , sec , rsizes , secidx , nrings , m , 32 ) ) ;
CHECK ( secp256k1_borromean_verify ( NULL , e0 , s , pubs , rsizes , nrings , m , 32 ) ) ;
2020-11-05 20:21:38 +00:00
i = secp256k1_testrand32 ( ) % c ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
secp256k1_scalar_negate ( & s [ i ] , & s [ i ] ) ;
2021-09-15 22:03:06 +00:00
CHECK ( ! secp256k1_borromean_verify ( NULL , e0 , s , pubs , rsizes , nrings , m , 32 ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
secp256k1_scalar_negate ( & s [ i ] , & s [ i ] ) ;
secp256k1_scalar_set_int ( & one , 1 ) ;
for ( j = 0 ; j < 4 ; j + + ) {
2020-11-05 20:21:38 +00:00
i = secp256k1_testrand32 ( ) % c ;
if ( secp256k1_testrand32 ( ) & 1 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
secp256k1_gej_double_var ( & pubs [ i ] , & pubs [ i ] , NULL ) ;
} else {
secp256k1_scalar_add ( & s [ i ] , & s [ i ] , & one ) ;
}
2021-09-15 22:03:06 +00:00
CHECK ( ! secp256k1_borromean_verify ( NULL , e0 , s , pubs , rsizes , nrings , m , 32 ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
}
2016-07-06 15:44:09 +00:00
static void test_rangeproof ( void ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
const uint64_t testvs [ 11 ] = { 0 , 1 , 5 , 11 , 65535 , 65537 , INT32_MAX , UINT32_MAX , INT64_MAX - 1 , INT64_MAX , UINT64_MAX } ;
2016-07-04 13:04:57 +00:00
secp256k1_pedersen_commitment commit ;
secp256k1_pedersen_commitment commit2 ;
2018-05-24 13:23:08 +02:00
unsigned char proof [ 5134 + 1 ] ; /* One additional byte to test if trailing bytes are rejected */
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
unsigned char blind [ 32 ] ;
unsigned char blindout [ 32 ] ;
unsigned char message [ 4096 ] ;
2016-07-04 13:04:57 +00:00
size_t mlen ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
uint64_t v ;
uint64_t vout ;
uint64_t vmin ;
uint64_t minv ;
uint64_t maxv ;
2016-07-04 13:04:57 +00:00
size_t len ;
size_t i ;
size_t j ;
size_t k ;
2016-07-05 15:46:07 +00:00
/* Short message is a Simone de Beauvoir quote */
const unsigned char message_short [ 120 ] = " When I see my own likeness in the depths of someone else's consciousness, I always experience a moment of panic. " ;
/* Long message is 0xA5 with a bunch of this quote in the middle */
unsigned char message_long [ 3968 ] ;
memset ( message_long , 0xa5 , sizeof ( message_long ) ) ;
for ( i = 1200 ; i < 3600 ; i + = 120 ) {
memcpy ( & message_long [ i ] , message_short , sizeof ( message_short ) ) ;
}
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( blind ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( i = 0 ; i < 11 ; i + + ) {
v = testvs [ i ] ;
2016-07-06 13:46:23 +02:00
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , v , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( vmin = 0 ; vmin < ( i < 9 & & i > 0 ? 2 : 1 ) ; vmin + + ) {
2016-07-05 15:46:07 +00:00
const unsigned char * input_message = NULL ;
size_t input_message_len = 0 ;
/* vmin is always either 0 or 1; if it is 1, then we have no room for a message.
* If it ' s 0 , we use " minimum encoding " and only have room for a small message when
* ` testvs [ i ] ` is > = 4 ; for a large message when it ' s > = 2 ^ 32. */
if ( vmin = = 0 & & i > 2 ) {
input_message = message_short ;
input_message_len = sizeof ( message_short ) ;
}
if ( vmin = = 0 & & i > 7 ) {
input_message = message_long ;
input_message_len = sizeof ( message_long ) ;
}
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
len = 5134 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , vmin , & commit , blind , commit . data , 0 , 0 , v , input_message , input_message_len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( len < = 5134 ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , 0 ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
mlen = 4096 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_rewind ( ctx , blindout , & vout , message , & mlen , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
2016-07-05 15:46:07 +00:00
if ( input_message ! = NULL ) {
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( message , input_message , input_message_len ) = = 0 ) ;
2016-07-05 15:46:07 +00:00
}
for ( j = input_message_len ; j < mlen ; j + + ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( message [ j ] = = 0 ) ;
}
CHECK ( mlen < = 4096 ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( blindout , blind , 32 ) = = 0 ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( vout = = v ) ;
CHECK ( minv < = v ) ;
CHECK ( maxv > = v ) ;
len = 5134 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , v , & commit , blind , commit . data , - 1 , 64 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( len < = 73 ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , 0 ) ) ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_rewind ( ctx , blindout , & vout , NULL , NULL , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( blindout , blind , 32 ) = = 0 ) ;
2016-07-06 15:44:09 +00:00
CHECK ( vout = = v ) ;
CHECK ( minv = = v ) ;
CHECK ( maxv = = v ) ;
/* Check with a committed message */
len = 5134 ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , v , & commit , blind , commit . data , - 1 , 64 , v , NULL , 0 , message_short , sizeof ( message_short ) , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( len < = 73 ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , 0 ) ) ;
2016-07-06 15:44:09 +00:00
CHECK ( ! secp256k1_rangeproof_rewind ( ctx , blindout , & vout , NULL , NULL , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( ! secp256k1_rangeproof_rewind ( ctx , blindout , & vout , NULL , NULL , commit . data , & minv , & maxv , & commit , proof , len , message_long , sizeof ( message_long ) , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_rewind ( ctx , blindout , & vout , NULL , NULL , commit . data , & minv , & maxv , & commit , proof , len , message_short , sizeof ( message_short ) , secp256k1_generator_h ) ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( blindout , blind , 32 ) = = 0 ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( vout = = v ) ;
CHECK ( minv = = v ) ;
CHECK ( maxv = = v ) ;
}
}
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( blind ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
v = INT64_MAX - 1 ;
2016-07-06 13:46:23 +02:00
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , v , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( i = 0 ; i < 19 ; i + + ) {
len = 5134 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , 0 , & commit , blind , commit . data , i , 0 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , 0 ) ) ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( len < = 5134 ) ;
CHECK ( minv < = v ) ;
CHECK ( maxv > = v ) ;
2016-07-06 15:44:09 +00:00
/* Make sure it fails when validating with a committed message */
CHECK ( ! secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , message_short , sizeof ( message_short ) , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( blind ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
{
/*Malleability test.*/
2020-11-05 22:07:30 +00:00
v = secp256k1_testrandi64 ( 0 , 255 ) ;
2016-07-06 13:46:23 +02:00
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , v , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
len = 5134 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , 0 , & commit , blind , commit . data , 0 , 3 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( len < = 5134 ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , 3 ) ) ;
2018-05-24 13:23:08 +02:00
/* Test if trailing bytes are rejected. */
proof [ len ] = v ;
CHECK ( ! secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len + 1 , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( i = 0 ; i < len * 8 ; i + + ) {
proof [ i > > 3 ] ^ = 1 < < ( i & 7 ) ;
2016-07-06 15:44:09 +00:00
CHECK ( ! secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
proof [ i > > 3 ] ^ = 1 < < ( i & 7 ) ;
}
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( minv < = v ) ;
CHECK ( maxv > = v ) ;
}
2016-07-04 13:04:57 +00:00
memcpy ( & commit2 , & commit , sizeof ( commit ) ) ;
2020-11-16 16:05:24 +00:00
for ( i = 0 ; i < ( size_t ) count ; i + + ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
int exp ;
int min_bits ;
2020-11-05 22:07:30 +00:00
v = secp256k1_testrandi64 ( 0 , UINT64_MAX > > ( secp256k1_testrand32 ( ) & 63 ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
vmin = 0 ;
2020-11-05 20:21:38 +00:00
if ( ( v < INT64_MAX ) & & ( secp256k1_testrand32 ( ) & 1 ) ) {
2020-11-05 22:07:30 +00:00
vmin = secp256k1_testrandi64 ( 0 , v ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( blind ) ;
2016-07-06 13:46:23 +02:00
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , v , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
len = 5134 ;
2020-11-05 22:07:30 +00:00
exp = ( int ) secp256k1_testrandi64 ( 0 , 18 ) - ( int ) secp256k1_testrandi64 ( 0 , 18 ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
if ( exp < 0 ) {
exp = - exp ;
}
2020-11-05 22:07:30 +00:00
min_bits = ( int ) secp256k1_testrandi64 ( 0 , 64 ) - ( int ) secp256k1_testrandi64 ( 0 , 64 ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
if ( min_bits < 0 ) {
min_bits = - min_bits ;
}
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , vmin , & commit , blind , commit . data , exp , min_bits , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( len < = 5134 ) ;
2022-08-13 00:37:20 +00:00
CHECK ( len < = secp256k1_rangeproof_max_size ( ctx , v , min_bits ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
mlen = 4096 ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_rewind ( ctx , blindout , & vout , message , & mlen , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( j = 0 ; j < mlen ; j + + ) {
CHECK ( message [ j ] = = 0 ) ;
}
CHECK ( mlen < = 4096 ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( blindout , blind , 32 ) = = 0 ) ;
2019-01-03 19:17:05 +00:00
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
CHECK ( minv < = v ) ;
CHECK ( maxv > = v ) ;
2016-07-06 15:44:09 +00:00
CHECK ( secp256k1_rangeproof_rewind ( ctx , blindout , & vout , NULL , NULL , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
2016-07-04 13:04:57 +00:00
memcpy ( & commit2 , & commit , sizeof ( commit ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
2020-11-16 16:05:24 +00:00
for ( j = 0 ; j < 3 ; j + + ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
for ( i = 0 ; i < 96 ; i + + ) {
2020-11-05 20:21:38 +00:00
secp256k1_testrand256 ( & proof [ i * 32 ] ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
2020-11-16 16:05:24 +00:00
for ( k = 0 ; k < 128 ; k + = 3 ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
len = k ;
2016-07-06 15:44:09 +00:00
CHECK ( ! secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit2 , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
2020-11-05 22:07:30 +00:00
len = secp256k1_testrandi64 ( 0 , 3072 ) ;
2016-07-06 15:44:09 +00:00
CHECK ( ! secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit2 , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
}
2022-08-05 21:05:09 +00:00
static void test_rangeproof_null_blinder ( void ) {
unsigned char proof [ 5134 ] ;
const unsigned char blind [ 32 ] = { 0 } ;
const uint64_t v = 1111 ;
uint64_t minv , maxv ;
secp256k1_pedersen_commitment commit ;
size_t len ;
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , v , secp256k1_generator_h ) ) ;
/* Try a 32-bit proof; should work */
len = 5134 ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , 1 , & commit , blind , commit . data , 0 , 32 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( minv = = 1 ) ;
CHECK ( maxv = = 1ULL < < 32 ) ;
/* Try a 3-bit proof; should work */
len = 5134 ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , v - 1 , & commit , blind , commit . data , 0 , 3 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_verify ( ctx , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( minv = = 1110 ) ;
CHECK ( maxv = = 1117 ) ;
/* But a 2-bits will not because then it does not have any subcommitments (which rerandomize
* the blinding factors that get passed into the borromean logic . . . passing 0 s will fail ) */
len = 5134 ;
CHECK ( ! secp256k1_rangeproof_sign ( ctx , proof , & len , v - 1 , & commit , blind , commit . data , 0 , 2 , v , NULL , 0 , NULL , 0 , secp256k1_generator_h ) ) ;
/* Rewinding with 3-bits works */
{
uint64_t value_out ;
unsigned char msg [ 128 ] ;
unsigned char msg_out [ 128 ] ;
unsigned char blind_out [ 32 ] ;
size_t msg_len = sizeof ( msg ) ;
len = 1000 ;
secp256k1_testrand256 ( msg ) ;
secp256k1_testrand256 ( & msg [ 32 ] ) ;
secp256k1_testrand256 ( & msg [ 64 ] ) ;
secp256k1_testrand256 ( & msg [ 96 ] ) ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & len , v , & commit , blind , commit . data , 0 , 3 , v , msg , sizeof ( msg ) , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_rewind ( ctx , blind_out , & value_out , msg_out , & msg_len , commit . data , & minv , & maxv , & commit , proof , len , NULL , 0 , secp256k1_generator_h ) ! = 0 ) ;
2022-08-10 22:14:31 +00:00
CHECK ( secp256k1_memcmp_var ( blind , blind_out , sizeof ( blind ) ) = = 0 ) ;
CHECK ( secp256k1_memcmp_var ( msg , msg_out , sizeof ( msg ) ) = = 0 ) ;
2022-08-05 21:05:09 +00:00
CHECK ( value_out = = v ) ;
CHECK ( minv = = v ) ;
CHECK ( maxv = = v + 7 ) ;
}
}
2021-10-17 00:16:57 +00:00
static void test_single_value_proof ( uint64_t val ) {
unsigned char proof [ 5000 ] ;
secp256k1_pedersen_commitment commit ;
unsigned char blind [ 32 ] ;
unsigned char blind_out [ 32 ] ;
unsigned char nonce [ 32 ] ;
const unsigned char message [ 1 ] = " " ; /* no message will fit into a single-value proof */
unsigned char message_out [ sizeof ( proof ) ] = { 0 } ;
size_t plen = sizeof ( proof ) ;
uint64_t min_val_out = 0 ;
uint64_t max_val_out = 0 ;
uint64_t val_out = 0 ;
size_t m_len_out = 0 ;
secp256k1_testrand256 ( blind ) ;
secp256k1_testrand256 ( nonce ) ;
CHECK ( secp256k1_pedersen_commit ( ctx , & commit , blind , val , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_sign (
ctx ,
proof , & plen ,
val , /* min_val */
& commit , blind , nonce ,
- 1 , /* exp: -1 is magic value to indicate a single-value proof */
0 , /* min_bits */
val , /* val */
message , sizeof ( message ) , /* Will cause this to fail */
NULL , 0 ,
secp256k1_generator_h
) = = 0 ) ;
plen = sizeof ( proof ) ;
CHECK ( secp256k1_rangeproof_sign (
ctx ,
proof , & plen ,
val , /* min_val */
& commit , blind , nonce ,
- 1 , /* exp: -1 is magic value to indicate a single-value proof */
0 , /* min_bits */
val , /* val */
NULL , 0 ,
NULL , 0 ,
secp256k1_generator_h
) = = 1 ) ;
2022-08-20 16:06:46 +00:00
CHECK ( plen < = secp256k1_rangeproof_max_size ( ctx , val , 0 ) ) ;
2021-10-17 00:16:57 +00:00
/* Different proof sizes are unfortunate but is caused by `min_value` of
* zero being special - cased and encoded more efficiently . */
if ( val = = 0 ) {
CHECK ( plen = = 65 ) ;
} else {
CHECK ( plen = = 73 ) ;
}
CHECK ( secp256k1_rangeproof_verify (
ctx ,
& min_val_out , & max_val_out ,
& commit ,
proof , plen ,
NULL , 0 ,
secp256k1_generator_h
) = = 1 ) ;
CHECK ( min_val_out = = val ) ;
CHECK ( max_val_out = = val ) ;
memset ( message_out , 0 , sizeof ( message_out ) ) ;
m_len_out = sizeof ( message_out ) ;
CHECK ( secp256k1_rangeproof_rewind (
ctx ,
blind_out , & val_out ,
message_out , & m_len_out ,
nonce ,
& min_val_out , & max_val_out ,
& commit ,
proof , plen ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( val_out = = val ) ;
CHECK ( min_val_out = = val ) ;
CHECK ( max_val_out = = val ) ;
CHECK ( m_len_out = = 0 ) ;
CHECK ( secp256k1_memcmp_var ( blind , blind_out , 32 ) = = 0 ) ;
for ( m_len_out = 0 ; m_len_out < sizeof ( message_out ) ; m_len_out + + ) {
CHECK ( message_out [ m_len_out ] = = 0 ) ;
}
}
2016-07-06 15:44:09 +00:00
# define MAX_N_GENS 30
2021-10-17 00:16:57 +00:00
static void test_multiple_generators ( void ) {
2020-11-05 20:21:38 +00:00
const size_t n_inputs = ( secp256k1_testrand32 ( ) % ( MAX_N_GENS / 2 ) ) + 1 ;
const size_t n_outputs = ( secp256k1_testrand32 ( ) % ( MAX_N_GENS / 2 ) ) + 1 ;
2016-07-06 15:44:09 +00:00
const size_t n_generators = n_inputs + n_outputs ;
unsigned char * generator_blind [ MAX_N_GENS ] ;
unsigned char * pedersen_blind [ MAX_N_GENS ] ;
secp256k1_generator generator [ MAX_N_GENS ] ;
secp256k1_pedersen_commitment commit [ MAX_N_GENS ] ;
const secp256k1_pedersen_commitment * commit_ptr [ MAX_N_GENS ] ;
size_t i ;
int64_t total_value ;
uint64_t value [ MAX_N_GENS ] ;
secp256k1_scalar s ;
unsigned char generator_seed [ 32 ] ;
random_scalar_order ( & s ) ;
secp256k1_scalar_get_b32 ( generator_seed , & s ) ;
/* Create all the needed generators */
for ( i = 0 ; i < n_generators ; i + + ) {
generator_blind [ i ] = ( unsigned char * ) malloc ( 32 ) ;
pedersen_blind [ i ] = ( unsigned char * ) malloc ( 32 ) ;
random_scalar_order ( & s ) ;
secp256k1_scalar_get_b32 ( generator_blind [ i ] , & s ) ;
random_scalar_order ( & s ) ;
secp256k1_scalar_get_b32 ( pedersen_blind [ i ] , & s ) ;
CHECK ( secp256k1_generator_generate_blinded ( ctx , & generator [ i ] , generator_seed , generator_blind [ i ] ) ) ;
commit_ptr [ i ] = & commit [ i ] ;
}
/* Compute all the values -- can be positive or negative */
total_value = 0 ;
for ( i = 0 ; i < n_outputs ; i + + ) {
2020-11-05 22:07:30 +00:00
value [ n_inputs + i ] = secp256k1_testrandi64 ( 0 , INT64_MAX - total_value ) ;
2016-07-06 15:44:09 +00:00
total_value + = value [ n_inputs + i ] ;
}
for ( i = 0 ; i < n_inputs - 1 ; i + + ) {
2020-11-05 22:07:30 +00:00
value [ i ] = secp256k1_testrandi64 ( 0 , total_value ) ;
2016-07-06 15:44:09 +00:00
total_value - = value [ i ] ;
}
value [ i ] = total_value ;
/* Correct for blinding factors and do the commitments */
CHECK ( secp256k1_pedersen_blind_generator_blind_sum ( ctx , value , ( const unsigned char * const * ) generator_blind , pedersen_blind , n_generators , n_inputs ) ) ;
for ( i = 0 ; i < n_generators ; i + + ) {
CHECK ( secp256k1_pedersen_commit ( ctx , & commit [ i ] , pedersen_blind [ i ] , value [ i ] , & generator [ i ] ) ) ;
}
/* Verify */
CHECK ( secp256k1_pedersen_verify_tally ( ctx , & commit_ptr [ 0 ] , n_inputs , & commit_ptr [ n_inputs ] , n_outputs ) ) ;
2017-04-22 18:31:28 +00:00
/* Cleanup */
for ( i = 0 ; i < n_generators ; i + + ) {
free ( generator_blind [ i ] ) ;
free ( pedersen_blind [ i ] ) ;
}
2016-07-06 15:44:09 +00:00
}
2018-10-02 17:58:39 +00:00
void test_rangeproof_fixed_vectors ( void ) {
2021-10-17 00:16:57 +00:00
size_t i ;
unsigned char blind [ 32 ] ;
uint64_t value ;
uint64_t min_value ;
uint64_t max_value ;
secp256k1_pedersen_commitment pc ;
unsigned char message [ 4000 ] = { 0 } ;
size_t m_len = sizeof ( message ) ;
/* Vector 1: no message */
{
static const unsigned char vector_1 [ ] = {
2018-10-02 17:58:39 +00:00
0x62 , 0x07 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x56 , 0x02 , 0x2a , 0x5c , 0x42 , 0x0e , 0x1d ,
0x51 , 0xe1 , 0xb7 , 0xf3 , 0x69 , 0x04 , 0xb5 , 0xbb , 0x9b , 0x41 , 0x66 , 0x14 , 0xf3 , 0x64 , 0x42 , 0x26 ,
0xe3 , 0xa7 , 0x6a , 0x06 , 0xbb , 0xa8 , 0x5a , 0x49 , 0x6f , 0x19 , 0x76 , 0xfb , 0xe5 , 0x75 , 0x77 , 0x88 ,
0xab , 0xa9 , 0x66 , 0x44 , 0x80 , 0xea , 0x29 , 0x95 , 0x7f , 0xdf , 0x72 , 0x4a , 0xaf , 0x02 , 0xbe , 0xdd ,
0x5d , 0x15 , 0xd8 , 0xae , 0xff , 0x74 , 0xc9 , 0x8c , 0x1a , 0x67 , 0x0e , 0xb2 , 0x57 , 0x22 , 0x99 , 0xc3 ,
0x21 , 0x46 , 0x6f , 0x15 , 0x58 , 0x0e , 0xdb , 0xe6 , 0x6e , 0xc4 , 0x0d , 0xfe , 0x6f , 0x04 , 0x6b , 0x0d ,
0x18 , 0x3d , 0x78 , 0x40 , 0x98 , 0x56 , 0x4e , 0xe4 , 0x4a , 0x74 , 0x90 , 0xa7 , 0xac , 0x9c , 0x16 , 0xe0 ,
0x3e , 0x81 , 0xaf , 0x0f , 0xe3 , 0x4f , 0x34 , 0x99 , 0x52 , 0xf7 , 0xa7 , 0xf6 , 0xd3 , 0x83 , 0xa0 , 0x17 ,
0x4b , 0x2d , 0xa7 , 0xd4 , 0xfd , 0xf7 , 0x84 , 0x45 , 0xc4 , 0x11 , 0x71 , 0x3d , 0x4a , 0x22 , 0x34 , 0x09 ,
0x9c , 0xa7 , 0xe5 , 0xc8 , 0xba , 0x04 , 0xbf , 0xfd , 0x25 , 0x11 , 0x7d , 0xa4 , 0x43 , 0x45 , 0xc7 , 0x62 ,
0x9e , 0x7b , 0x80 , 0xf6 , 0x09 , 0xbb , 0x1b , 0x2e , 0xf3 , 0xcd , 0x23 , 0xe0 , 0xed , 0x81 , 0x43 , 0x42 ,
0xbe , 0xc4 , 0x9f , 0x58 , 0x8a , 0x0d , 0x66 , 0x79 , 0x09 , 0x70 , 0x11 , 0x68 , 0x3d , 0x87 , 0x38 , 0x1c ,
0x3c , 0x85 , 0x52 , 0x5b , 0x62 , 0xf7 , 0x3e , 0x7e , 0x87 , 0xa2 , 0x99 , 0x24 , 0xd0 , 0x7d , 0x18 , 0x63 ,
0x56 , 0x48 , 0xa4 , 0x3a , 0xfe , 0x65 , 0xfa , 0xa4 , 0xd0 , 0x67 , 0xaa , 0x98 , 0x65 , 0x4d , 0xe4 , 0x22 ,
0x75 , 0x45 , 0x52 , 0xe8 , 0x41 , 0xc7 , 0xed , 0x38 , 0xeb , 0xf5 , 0x02 , 0x90 , 0xc9 , 0x45 , 0xa3 , 0xb0 ,
0x4d , 0x03 , 0xd7 , 0xab , 0x43 , 0xe4 , 0x21 , 0xfc , 0x83 , 0xd6 , 0x12 , 0x1d , 0x76 , 0xb1 , 0x3c , 0x67 ,
0x63 , 0x1f , 0x52 , 0x9d , 0xc3 , 0x23 , 0x5c , 0x4e , 0xa6 , 0x8d , 0x01 , 0x4a , 0xba , 0x9a , 0xf4 , 0x16 ,
0x5b , 0x67 , 0xc8 , 0xe1 , 0xd2 , 0x42 , 0x6d , 0xdf , 0xcd , 0x08 , 0x6a , 0x73 , 0x41 , 0x6a , 0xc2 , 0x84 ,
0xc6 , 0x31 , 0xbe , 0x57 , 0xcb , 0x0e , 0xde , 0xbf , 0x71 , 0xd5 , 0x8a , 0xf7 , 0x24 , 0xb2 , 0xa7 , 0x89 ,
0x96 , 0x62 , 0x4f , 0xd9 , 0xf7 , 0xc3 , 0xde , 0x4c , 0xab , 0x13 , 0x72 , 0xb4 , 0xb3 , 0x35 , 0x04 , 0x82 ,
0xa8 , 0x75 , 0x1d , 0xde , 0x46 , 0xa8 , 0x0d , 0xb8 , 0x23 , 0x44 , 0x00 , 0x44 , 0xfa , 0x53 , 0x6c , 0x2d ,
0xce , 0xd3 , 0xa6 , 0x80 , 0xa1 , 0x20 , 0xca , 0xd1 , 0x63 , 0xbb , 0xbe , 0x39 , 0x5f , 0x9d , 0x27 , 0x69 ,
0xb3 , 0x33 , 0x1f , 0xdb , 0xda , 0x67 , 0x05 , 0x37 , 0xbe , 0x65 , 0xe9 , 0x7e , 0xa9 , 0xc3 , 0xff , 0x37 ,
0x8a , 0xb4 , 0x2d , 0xfe , 0xf2 , 0x16 , 0x85 , 0xc7 , 0x0f , 0xd9 , 0xbe , 0x14 , 0xd1 , 0x80 , 0x14 , 0x9f ,
0x58 , 0x56 , 0x98 , 0x41 , 0xf6 , 0x26 , 0xf7 , 0xa2 , 0x71 , 0x66 , 0xb4 , 0x7a , 0x9c , 0x12 , 0x73 , 0xd3 ,
0xdf , 0x77 , 0x2b , 0x49 , 0xe5 , 0xca , 0x50 , 0x57 , 0x44 , 0x6e , 0x3f , 0x58 , 0x56 , 0xbc , 0x21 , 0x70 ,
0x4f , 0xc6 , 0xaa , 0x12 , 0xff , 0x7c , 0xa7 , 0x3d , 0xed , 0x46 , 0xc1 , 0x40 , 0xe6 , 0x58 , 0x09 , 0x2a ,
0xda , 0xb3 , 0x76 , 0xab , 0x44 , 0xb5 , 0x4e , 0xb3 , 0x12 , 0xe0 , 0x26 , 0x8a , 0x52 , 0xac , 0x49 , 0x1d ,
0xe7 , 0x06 , 0x53 , 0x3a , 0x01 , 0x35 , 0x21 , 0x2e , 0x86 , 0x48 , 0xc5 , 0x75 , 0xc1 , 0xa2 , 0x7d , 0x22 ,
0x53 , 0xf6 , 0x3f , 0x41 , 0xc5 , 0xb3 , 0x08 , 0x7d , 0xa3 , 0x67 , 0xc0 , 0xbb , 0xb6 , 0x8d , 0xf0 , 0xd3 ,
0x01 , 0x72 , 0xd3 , 0x63 , 0x82 , 0x01 , 0x1a , 0xe7 , 0x1d , 0x22 , 0xfa , 0x95 , 0x33 , 0xf6 , 0xf2 , 0xde ,
0xa2 , 0x53 , 0x86 , 0x55 , 0x5a , 0xb4 , 0x2e , 0x75 , 0x75 , 0xc6 , 0xd5 , 0x93 , 0x9c , 0x57 , 0xa9 , 0x1f ,
0xb9 , 0x3e , 0xe8 , 0x1c , 0xbf , 0xac , 0x1c , 0x54 , 0x6f , 0xf5 , 0xab , 0x41 , 0xee , 0xb3 , 0x0e , 0xd0 ,
0x76 , 0xc4 , 0x1a , 0x45 , 0xcd , 0xf1 , 0xd6 , 0xcc , 0xb0 , 0x83 , 0x70 , 0x73 , 0xbc , 0x88 , 0x74 , 0xa0 ,
0x5b , 0xe7 , 0x98 , 0x10 , 0x36 , 0xbf , 0xec , 0x23 , 0x1c , 0xc2 , 0xb5 , 0xba , 0x4b , 0x9d , 0x7f , 0x8c ,
0x8a , 0xe2 , 0xda , 0x18 , 0xdd , 0xab , 0x27 , 0x8a , 0x15 , 0xeb , 0xb0 , 0xd4 , 0x3a , 0x8b , 0x77 , 0x00 ,
0xc7 , 0xbb , 0xcc , 0xfa , 0xba , 0xa4 , 0x6a , 0x17 , 0x5c , 0xf8 , 0x51 , 0x5d , 0x8d , 0x16 , 0xcd , 0xa7 ,
0x0e , 0x71 , 0x97 , 0x98 , 0x78 , 0x5a , 0x41 , 0xb3 , 0xf0 , 0x1f , 0x87 , 0x2d , 0x65 , 0xcd , 0x29 , 0x49 ,
0xd2 , 0x87 , 0x2c , 0x91 , 0xa9 , 0x5f , 0xcc , 0xa9 , 0xd8 , 0xbb , 0x53 , 0x18 , 0xe7 , 0xd6 , 0xec , 0x65 ,
0xa6 , 0x45 , 0xf6 , 0xce , 0xcf , 0x48 , 0xf6 , 0x1e , 0x3d , 0xd2 , 0xcf , 0xcb , 0x3a , 0xcd , 0xbb , 0x92 ,
0x29 , 0x24 , 0x16 , 0x7f , 0x8a , 0xa8 , 0x5c , 0x0c , 0x45 , 0x71 , 0x33
} ;
2021-10-17 00:16:57 +00:00
static const unsigned char commit_1 [ ] = {
2018-10-02 17:58:39 +00:00
0x08 ,
0xf5 , 0x1e , 0x0d , 0xc5 , 0x86 , 0x78 , 0x51 , 0xa9 , 0x00 , 0x00 , 0xef , 0x4d , 0xe2 , 0x94 , 0x60 , 0x89 ,
0x83 , 0x04 , 0xb4 , 0x0e , 0x90 , 0x10 , 0x05 , 0x1c , 0x7f , 0xd7 , 0x33 , 0x92 , 0x1f , 0xe7 , 0x74 , 0x59
} ;
2021-10-17 00:16:57 +00:00
static const unsigned char blind_1 [ ] = {
0x98 , 0x44 , 0xfc , 0x7a , 0x64 , 0xa9 , 0xca , 0xdf , 0xf3 , 0x2f , 0x9f , 0x02 , 0xba , 0x46 , 0xc7 , 0xd9 ,
0x77 , 0x47 , 0xa4 , 0xd3 , 0x53 , 0x17 , 0xc6 , 0x44 , 0x30 , 0x73 , 0x84 , 0xeb , 0x1f , 0xbe , 0xa1 , 0xfb
} ;
2018-10-02 17:58:39 +00:00
CHECK ( secp256k1_pedersen_commitment_parse ( ctx , & pc , commit_1 ) ) ;
CHECK ( secp256k1_rangeproof_verify (
ctx ,
2021-10-17 00:16:57 +00:00
& min_value , & max_value ,
2018-10-02 17:58:39 +00:00
& pc ,
vector_1 , sizeof ( vector_1 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
2021-10-17 00:16:57 +00:00
CHECK ( min_value = = 86 ) ;
CHECK ( max_value = = 25586 ) ;
CHECK ( secp256k1_rangeproof_rewind (
ctx ,
blind , & value ,
message , & m_len ,
pc . data ,
& min_value , & max_value ,
& pc ,
vector_1 , sizeof ( vector_1 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( secp256k1_memcmp_var ( blind , blind_1 , 32 ) = = 0 ) ;
CHECK ( value = = 86 ) ;
CHECK ( min_value = = 86 ) ;
CHECK ( max_value = = 25586 ) ;
CHECK ( m_len = = 448 ) ; /* length of the sidechannel in the proof */
for ( i = 0 ; i < m_len ; i + + ) {
/* No message encoded in this vector */
CHECK ( message [ i ] = = 0 ) ;
}
}
/* Vector 2: embedded message */
{
static const unsigned char vector_2 [ ] = {
0x40 , 0x03 , 0x00 , 0x90 , 0x1a , 0x61 , 0x64 , 0xbb , 0x85 , 0x1a , 0x78 , 0x35 , 0x1e , 0xe0 , 0xd5 , 0x96 ,
0x71 , 0x0f , 0x18 , 0x8e , 0xf3 , 0x33 , 0xf0 , 0x75 , 0xfe , 0xd6 , 0xc6 , 0x11 , 0x6b , 0x42 , 0x89 , 0xea ,
0xa2 , 0x0c , 0x89 , 0x25 , 0x37 , 0x81 , 0x10 , 0xf9 , 0xf0 , 0x9b , 0xda , 0x68 , 0x2a , 0xd9 , 0x2e , 0x0c ,
0x45 , 0x17 , 0x54 , 0x6d , 0x02 , 0xd2 , 0x21 , 0x5d , 0xbc , 0x10 , 0xf8 , 0x8f , 0xf1 , 0x92 , 0x40 , 0xa9 ,
0xc7 , 0x24 , 0x00 , 0x1b , 0xc8 , 0x75 , 0x0f , 0xf6 , 0x8f , 0x93 , 0x8b , 0x78 , 0x62 , 0x73 , 0x3c , 0x86 ,
0x4b , 0x61 , 0x7c , 0x0f , 0xc6 , 0x41 , 0xc9 , 0xb3 , 0xc1 , 0x30 , 0x7f , 0xd4 , 0xee , 0x9f , 0x37 , 0x08 ,
0x9b , 0x64 , 0x23 , 0xd5 , 0xe6 , 0x1a , 0x03 , 0x54 , 0x74 , 0x9b , 0x0b , 0xae , 0x6f , 0x2b , 0x1e , 0xf5 ,
0x40 , 0x44 , 0xaa , 0x12 , 0xe8 , 0xbd , 0xe0 , 0xa6 , 0x85 , 0x89 , 0xf1 , 0xa9 , 0xd0 , 0x3f , 0x2e , 0xc6 ,
0x1f , 0x11 , 0xf5 , 0x44 , 0x69 , 0x99 , 0x31 , 0x10 , 0x2e , 0x64 , 0xc6 , 0x44 , 0xdb , 0x47 , 0x06 , 0x6d ,
0xd5 , 0xf2 , 0x8d , 0x19 , 0x00 , 0x39 , 0xb8 , 0xca , 0xda , 0x5c , 0x1d , 0x83 , 0xbd , 0xa3 , 0x6d , 0xbf ,
0x97 , 0xdd , 0x83 , 0x86 , 0xc9 , 0x56 , 0xe2 , 0xbb , 0x37 , 0x4b , 0x2d , 0xb5 , 0x9d , 0xf2 , 0x7a , 0x6a ,
0x25 , 0x47 , 0xfa , 0x03 , 0x05 , 0xc5 , 0xda , 0x73 , 0xe1 , 0x96 , 0x15 , 0x21 , 0x23 , 0xe5 , 0xef , 0x55 ,
0x36 , 0xdd , 0xf1 , 0xb1 , 0x3f , 0x33 , 0x1a , 0x91 , 0x6c , 0x73 , 0x64 , 0xd3 , 0x88 , 0xe7 , 0xc6 , 0xc9 ,
0x04 , 0x29 , 0xae , 0x55 , 0x27 , 0xa0 , 0x80 , 0x60 , 0xaf , 0x0c , 0x09 , 0x2f , 0xc8 , 0x1b , 0xe6 , 0x16 ,
0x9e , 0xed , 0x29 , 0xc7 , 0x93 , 0xce , 0xc7 , 0x0d , 0xdf , 0x1f , 0x28 , 0xba , 0xf3 , 0x38 , 0xc3 , 0xaa ,
0x99 , 0xd9 , 0x21 , 0x41 , 0xb8 , 0x10 , 0xa5 , 0x48 , 0x37 , 0xec , 0x60 , 0xda , 0x64 , 0x5a , 0x73 , 0x55 ,
0xd7 , 0xff , 0x23 , 0xfa , 0xf6 , 0xc6 , 0xf4 , 0xe2 , 0xca , 0x99 , 0x2f , 0x30 , 0x36 , 0x48 , 0x73 , 0x8b ,
0x57 , 0xa6 , 0x62 , 0x12 , 0xa3 , 0xe7 , 0x5c , 0xa8 , 0xd1 , 0xe6 , 0x85 , 0x05 , 0x59 , 0xfe , 0x2b , 0x44 ,
0xe4 , 0x73 , 0x1c , 0xc3 , 0x56 , 0x32 , 0x07 , 0x65 , 0x4a , 0x58 , 0xaf , 0x2b , 0x3f , 0x36 , 0xca , 0xb4 ,
0x1d , 0x5c , 0x2a , 0x46 , 0x1f , 0xf7 , 0x63 , 0x59 , 0x4f , 0x2b , 0xd0 , 0xf6 , 0xfc , 0xcf , 0x04 , 0x09 ,
0xb7 , 0x65 , 0x1b
} ;
static const unsigned char commit_2 [ ] = {
0x09 ,
0x25 , 0xa4 , 0xbd , 0xc4 , 0x57 , 0x69 , 0xeb , 0x4f , 0x34 , 0x0f , 0xea , 0xb8 , 0xe4 , 0x72 , 0x04 , 0x54 ,
0x06 , 0xe5 , 0xd6 , 0x85 , 0x15 , 0x42 , 0xea , 0x6e , 0x1d , 0x11 , 0x11 , 0x9c , 0x56 , 0xf8 , 0x10 , 0x45
} ;
static const unsigned char blind_2 [ ] = {
0xdc , 0x79 , 0x07 , 0x89 , 0x2d , 0xc4 , 0xe3 , 0x76 , 0xf9 , 0x13 , 0x38 , 0xd6 , 0x4b , 0x46 , 0xed , 0x9d ,
0x9b , 0xf6 , 0x70 , 0x3d , 0x04 , 0xcf , 0x96 , 0x8c , 0xfd , 0xb5 , 0xff , 0x0a , 0x06 , 0xc7 , 0x08 , 0x8b
} ;
static const unsigned char message_2 [ ] = " When I see my own likeness in the depths of someone else's consciousness, I always experience a moment of panic. " ;
CHECK ( secp256k1_pedersen_commitment_parse ( ctx , & pc , commit_2 ) ) ;
CHECK ( secp256k1_rangeproof_verify (
ctx ,
& min_value , & max_value ,
& pc ,
vector_2 , sizeof ( vector_2 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( min_value = = 0 ) ;
CHECK ( max_value = = 15 ) ;
CHECK ( secp256k1_rangeproof_rewind (
ctx ,
blind , & value ,
message , & m_len ,
pc . data ,
& min_value , & max_value ,
& pc ,
vector_2 , sizeof ( vector_2 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( secp256k1_memcmp_var ( blind , blind_2 , 32 ) = = 0 ) ;
CHECK ( value = = 11 ) ;
CHECK ( min_value = = 0 ) ;
CHECK ( max_value = = 15 ) ;
CHECK ( m_len = = 192 ) ; /* length of the sidechannel in the proof */
CHECK ( secp256k1_memcmp_var ( message , message_2 , sizeof ( message_2 ) ) = = 0 ) ;
for ( i = sizeof ( message_2 ) ; i < m_len ; i + + ) {
CHECK ( message [ i ] = = 0 ) ;
}
}
/* Vector 3: single-value proof of UINT64_MAX */
{
static const unsigned char vector_3 [ ] = {
0x20 , 0xff , 0xff , 0xff , 0xff , 0xff , 0xff , 0xff , 0xff , 0xdc , 0x7d , 0x0b , 0x79 , 0x0e , 0xaf , 0x41 ,
0xa5 , 0x8e , 0x9b , 0x0c , 0x5b , 0xa3 , 0xee , 0x7d , 0xfd , 0x3d , 0x6b , 0xf3 , 0xac , 0x04 , 0x8a , 0x43 ,
0x75 , 0xb0 , 0xb7 , 0x0e , 0x92 , 0xd7 , 0xdf , 0xf0 , 0x76 , 0xc4 , 0xa5 , 0xb6 , 0x2f , 0xf1 , 0xb5 , 0xfb ,
0xb4 , 0xb6 , 0x29 , 0xea , 0x34 , 0x9b , 0x16 , 0x30 , 0x0d , 0x06 , 0xf1 , 0xb4 , 0x3f , 0x0d , 0x73 , 0x59 ,
0x75 , 0xbf , 0x5d , 0x19 , 0x59 , 0xef , 0x11 , 0xf0 , 0xbf
} ;
static const unsigned char commit_3 [ ] = {
0x08 ,
0xc7 , 0xea , 0x40 , 0x7d , 0x26 , 0x38 , 0xa2 , 0x99 , 0xb9 , 0x40 , 0x22 , 0x78 , 0x17 , 0x57 , 0x65 , 0xb3 ,
0x36 , 0x82 , 0x18 , 0x42 , 0xc5 , 0x57 , 0x04 , 0x5e , 0x58 , 0x5e , 0xf6 , 0x40 , 0x8b , 0x24 , 0x73 , 0x10
} ;
static const unsigned char nonce_3 [ ] = {
0x84 , 0x50 , 0x94 , 0x69 , 0xa3 , 0x4b , 0x6c , 0x62 , 0x1a , 0xc7 , 0xe2 , 0x0e , 0x07 , 0x9a , 0x6f , 0x85 ,
0x5f , 0x26 , 0x50 , 0xcd , 0x88 , 0x5a , 0x9f , 0xaa , 0x23 , 0x5e , 0x0a , 0xe0 , 0x7e , 0xc5 , 0xe9 , 0xf1
} ;
static const unsigned char blind_3 [ ] = {
0x68 , 0x89 , 0x47 , 0x8c , 0x77 , 0xec , 0xcc , 0x2b , 0x65 , 0x01 , 0x78 , 0x6b , 0x06 , 0x8b , 0x38 , 0x94 ,
0xc0 , 0x6b , 0x9b , 0x4c , 0x02 , 0xa6 , 0xc8 , 0xf6 , 0xc0 , 0x34 , 0xea , 0x35 , 0x57 , 0xf4 , 0xe1 , 0x37
} ;
CHECK ( secp256k1_pedersen_commitment_parse ( ctx , & pc , commit_3 ) ) ;
CHECK ( secp256k1_rangeproof_verify (
ctx ,
& min_value , & max_value ,
& pc ,
vector_3 , sizeof ( vector_3 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( min_value = = UINT64_MAX ) ;
CHECK ( max_value = = UINT64_MAX ) ;
CHECK ( secp256k1_rangeproof_rewind (
ctx ,
blind , & value ,
message , & m_len ,
nonce_3 ,
& min_value , & max_value ,
& pc ,
vector_3 , sizeof ( vector_3 ) ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( secp256k1_memcmp_var ( blind , blind_3 , 32 ) = = 0 ) ;
CHECK ( value = = UINT64_MAX ) ;
CHECK ( min_value = = UINT64_MAX ) ;
CHECK ( max_value = = UINT64_MAX ) ;
CHECK ( m_len = = 0 ) ;
}
2018-10-02 17:58:39 +00:00
}
2022-01-12 12:23:41 +00:00
static void print_vector_helper ( unsigned char * buf , size_t buf_len ) {
size_t j ;
printf ( " " ) ;
for ( j = 0 ; j < buf_len ; j + + ) {
printf ( " 0x%02x " , buf [ j ] ) ;
if ( j = = buf_len - 1 ) {
printf ( " , \n " ) ;
} else if ( ( j + 1 ) % 16 ! = 0 ) {
printf ( " , " ) ;
} else {
printf ( " , \n " ) ;
printf ( " " ) ;
}
}
printf ( " }; \n " ) ;
}
static void print_vector ( int i , unsigned char * proof , size_t p_len , secp256k1_pedersen_commitment * commit ) {
unsigned char commit_output [ 33 ] ;
printf ( " unsigned char vector_%d[] = { \n " , i ) ;
print_vector_helper ( proof , p_len ) ;
CHECK ( secp256k1_pedersen_commitment_serialize ( ctx , commit_output , commit ) ) ;
printf ( " unsigned char commit_%d[] = { \n " , i ) ;
print_vector_helper ( commit_output , sizeof ( commit_output ) ) ;
}
/* Use same nonce and blinding value for all "reproducible" test vectors */
static unsigned char vector_blind [ ] = {
0x48 , 0x26 , 0xad , 0x41 , 0x37 , 0x4c , 0x25 , 0x62 , 0x52 , 0x14 , 0x78 , 0x82 , 0x89 , 0x9c , 0x86 , 0x27 ,
0xa1 , 0x19 , 0xf6 , 0xe1 , 0xfa , 0x44 , 0xe4 , 0x29 , 0x08 , 0xa7 , 0xb3 , 0x45 , 0xad , 0x35 , 0xb2 , 0xd9 ,
} ;
static unsigned char vector_nonce [ ] = {
0xc8 , 0x5c , 0x7e , 0x6c , 0xa1 , 0xfa , 0x11 , 0x35 , 0xc7 , 0x45 , 0x24 , 0x8a , 0xb5 , 0x28 , 0x6d , 0x1a ,
0x88 , 0x00 , 0xff , 0xca , 0x96 , 0x0f , 0xc7 , 0x77 , 0xa5 , 0x96 , 0x7a , 0x5e , 0xf8 , 0x88 , 0x2d , 0xd4 ,
} ;
/* Maximum length of a message that can be embedded into a rangeproof */
void test_rangeproof_fixed_vectors_reproducible_helper ( unsigned char * vector , size_t vector_len , unsigned char * commit , uint64_t * value_r , uint64_t * min_value_r , uint64_t * max_value_r , unsigned char * message_r , size_t * m_len_r ) {
secp256k1_pedersen_commitment pc ;
unsigned char blind_r [ 32 ] ;
CHECK ( secp256k1_pedersen_commitment_parse ( ctx , & pc , commit ) ) ;
CHECK ( secp256k1_rangeproof_verify (
ctx ,
min_value_r , max_value_r ,
& pc ,
vector , vector_len ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
* m_len_r = SECP256K1_RANGEPROOF_MAX_MESSAGE_LEN ;
CHECK ( secp256k1_rangeproof_rewind (
ctx ,
blind_r , value_r ,
message_r , m_len_r ,
vector_nonce ,
min_value_r , max_value_r ,
& pc ,
vector , vector_len ,
NULL , 0 ,
secp256k1_generator_h
) ) ;
CHECK ( secp256k1_memcmp_var ( blind_r , vector_blind , sizeof ( vector_blind ) ) = = 0 ) ;
}
void test_rangeproof_fixed_vectors_reproducible ( void ) {
uint64_t value_r ;
uint64_t min_value_r ;
uint64_t max_value_r ;
unsigned char message [ SECP256K1_RANGEPROOF_MAX_MESSAGE_LEN ] , message_r [ SECP256K1_RANGEPROOF_MAX_MESSAGE_LEN ] ;
size_t m_len_r ;
memset ( message , 0xFF , sizeof ( message ) ) ;
/* Test maximum values for value, min_bits, m_len and exp */
{
uint64_t value = UINT64_MAX ;
uint64_t min_value = 0 ;
size_t m_len = sizeof ( message ) ; /* maximum message length */
2022-08-20 16:06:46 +00:00
int min_bits = 64 ;
int exp = 18 ;
unsigned char proof [ 5126 ] ;
size_t p_len = sizeof ( proof ) ;
secp256k1_pedersen_commitment pc ;
2022-01-12 12:23:41 +00:00
unsigned char vector_0 [ ] = {
0x40 , 0x3f , 0xd1 , 0x77 , 0x65 , 0x05 , 0x87 , 0x88 , 0xd0 , 0x3d , 0xb2 , 0x24 , 0x60 , 0x7a , 0x08 , 0x76 ,
0xf8 , 0x9f , 0x5a , 0x00 , 0x73 , 0x32 , 0x6b , 0x5b , 0x0b , 0x59 , 0xda , 0xa0 , 0x6d , 0x2b , 0x66 , 0xb8 ,
0xfa , 0xa4 , 0x8c , 0xf9 , 0x78 , 0x5e , 0xe3 , 0xc7 , 0x30 , 0xea , 0xb4 , 0x31 , 0x77 , 0x3a , 0xe4 , 0xe3 ,
0xf0 , 0x76 , 0x15 , 0x21 , 0x07 , 0xb3 , 0x6e , 0x84 , 0x36 , 0xdb , 0x45 , 0xe6 , 0x2b , 0x14 , 0x50 , 0xf3 ,
0x53 , 0x5d , 0x79 , 0xf8 , 0x6d , 0xc4 , 0x99 , 0x36 , 0xa4 , 0x7c , 0xc1 , 0x14 , 0x90 , 0x99 , 0xa8 , 0x4b ,
0xf0 , 0x01 , 0x9f , 0xe7 , 0xd4 , 0xf9 , 0xf1 , 0x74 , 0xb0 , 0x7f , 0xf5 , 0x90 , 0x8d , 0x27 , 0x9e , 0x61 ,
0x9e , 0xc5 , 0xd0 , 0xa6 , 0x32 , 0xe8 , 0x64 , 0x4a , 0x02 , 0x8b , 0xbf , 0xf7 , 0xb8 , 0x31 , 0xa3 , 0x4d ,
0x99 , 0xbe , 0x12 , 0x77 , 0x4b , 0x07 , 0x4a , 0xef , 0x75 , 0xb4 , 0xb3 , 0x6e , 0x96 , 0x95 , 0xff , 0xe9 ,
0xf7 , 0xfc , 0x27 , 0x17 , 0x62 , 0xfa , 0x99 , 0xed , 0x00 , 0x3c , 0xdd , 0xaa , 0xae , 0x9e , 0x80 , 0xc1 ,
0x29 , 0x73 , 0x4d , 0xfc , 0x41 , 0xe6 , 0xb4 , 0x21 , 0xe2 , 0x62 , 0x78 , 0xf5 , 0x46 , 0xef , 0xcd , 0xcf ,
0x15 , 0x2a , 0x05 , 0x80 , 0xb9 , 0x95 , 0xaa , 0xa5 , 0xe9 , 0x69 , 0x5f , 0xfd , 0x58 , 0x12 , 0x00 , 0x51 ,
0xc4 , 0x8f , 0xa2 , 0xce , 0x03 , 0x7f , 0x16 , 0x19 , 0xb1 , 0x77 , 0xc2 , 0x98 , 0xbe , 0xaa , 0x18 , 0x6a ,
0x80 , 0x0b , 0x4a , 0x81 , 0x85 , 0xc0 , 0xc2 , 0x62 , 0xb3 , 0xec , 0xae , 0xe7 , 0x95 , 0xbf , 0xd3 , 0xe0 ,
0xcd , 0xa3 , 0xdd , 0x02 , 0x70 , 0x98 , 0x6c , 0xf3 , 0x4b , 0x43 , 0xec , 0x8d , 0x07 , 0xf4 , 0x3e , 0xb0 ,
0x00 , 0x7c , 0xb7 , 0x1a , 0x85 , 0x9a , 0x94 , 0xe8 , 0x57 , 0xc9 , 0x7e , 0x24 , 0xb4 , 0x7a , 0x84 , 0x17 ,
0x08 , 0xe6 , 0xae , 0x91 , 0x14 , 0xcb , 0x94 , 0xf3 , 0xe9 , 0x13 , 0x25 , 0x35 , 0x54 , 0xbf , 0x22 , 0xe9 ,
0xab , 0x8e , 0xa4 , 0xa1 , 0x18 , 0x78 , 0x6c , 0xee , 0x13 , 0x26 , 0xfc , 0x79 , 0xf1 , 0xe5 , 0x51 , 0x1e ,
0x0c , 0xac , 0xa5 , 0xef , 0x0d , 0xee , 0xe8 , 0x5f , 0x93 , 0xa4 , 0x88 , 0x4a , 0x32 , 0x95 , 0x8a , 0x61 ,
0x76 , 0xd8 , 0xac , 0x2d , 0x36 , 0x9a , 0x6b , 0xa4 , 0x7c , 0x30 , 0xa3 , 0x09 , 0x38 , 0xbb , 0xbc , 0x51 ,
0x1a , 0x10 , 0xae , 0x9e , 0x18 , 0x9f , 0xd8 , 0xc8 , 0xce , 0xfa , 0x63 , 0xab , 0x28 , 0xc9 , 0x76 , 0x28 ,
0x32 , 0x61 , 0x39 , 0x83 , 0x99 , 0x0a , 0x41 , 0xc0 , 0x55 , 0x1c , 0x65 , 0x6c , 0xcf , 0xc3 , 0x72 , 0x47 ,
0xe7 , 0xb1 , 0x99 , 0xb5 , 0x04 , 0x44 , 0xb9 , 0xde , 0x4b , 0x83 , 0x37 , 0x66 , 0xb2 , 0xee , 0x9f , 0x07 ,
0xf1 , 0x4f , 0x4d , 0x59 , 0xee , 0x37 , 0x79 , 0x47 , 0x0e , 0x31 , 0x70 , 0x3a , 0xfa , 0xe0 , 0xa1 , 0xef ,
0xa2 , 0x1f , 0xeb , 0xe8 , 0xd7 , 0x4f , 0xcb , 0xc2 , 0xce , 0xdc , 0x82 , 0xa6 , 0x36 , 0xed , 0x1d , 0xdd ,
0xa6 , 0x40 , 0x10 , 0x38 , 0x4f , 0x28 , 0x90 , 0xc3 , 0xe3 , 0xb6 , 0xa4 , 0x74 , 0xbb , 0x56 , 0x23 , 0x01 ,
0x3a , 0xb6 , 0xb1 , 0xad , 0x94 , 0x4b , 0x52 , 0x42 , 0x0a , 0x9d , 0xd6 , 0x89 , 0xdd , 0xa7 , 0x0f , 0x66 ,
0xdb , 0x4e , 0x5b , 0xa4 , 0xc2 , 0x11 , 0xd7 , 0xd5 , 0xf7 , 0x0a , 0xf1 , 0xc8 , 0x35 , 0x16 , 0xc0 , 0x7d ,
0x29 , 0x5d , 0x5c , 0x62 , 0x6b , 0xe0 , 0x1b , 0x74 , 0x8d , 0x14 , 0x9e , 0x08 , 0xb6 , 0x18 , 0x0d , 0x2b ,
0x3a , 0xfb , 0x22 , 0x9e , 0xd6 , 0x77 , 0x05 , 0x1b , 0xd4 , 0x5d , 0x25 , 0x27 , 0x97 , 0x40 , 0x93 , 0x58 ,
0x35 , 0xad , 0xc5 , 0x19 , 0x96 , 0x62 , 0xbb , 0x10 , 0x2d , 0x4e , 0x24 , 0x62 , 0xc0 , 0x1a , 0xe6 , 0x12 ,
0x84 , 0xac , 0x1b , 0x5e , 0x25 , 0xa9 , 0xc7 , 0x5d , 0xa0 , 0x34 , 0x85 , 0x70 , 0xf1 , 0x08 , 0xd8 , 0xf9 ,
0x1c , 0x1b , 0x71 , 0xcc , 0x72 , 0xec , 0xce , 0x30 , 0x91 , 0x67 , 0xac , 0xe5 , 0x4e , 0x51 , 0xa6 , 0x47 ,
0x74 , 0x09 , 0x19 , 0xee , 0x9d , 0x2d , 0x3f , 0xf2 , 0x49 , 0x5a , 0xf0 , 0x6c , 0x8f , 0xe9 , 0x1f , 0x10 ,
0xcc , 0x32 , 0x2f , 0x8d , 0x3e , 0xfa , 0xba , 0x0c , 0x37 , 0x51 , 0xe2 , 0x3e , 0xcc , 0xdd , 0x81 , 0xd5 ,
0xef , 0xef , 0x56 , 0x3a , 0xd2 , 0x96 , 0x10 , 0xfb , 0x19 , 0xce , 0x90 , 0xbf , 0x82 , 0x11 , 0xf6 , 0xe6 ,
0x28 , 0x7e , 0x4d , 0x16 , 0x61 , 0x87 , 0xdd , 0xc5 , 0x61 , 0x5d , 0x85 , 0xa9 , 0x02 , 0xea , 0xdf , 0x7a ,
0x2c , 0x92 , 0xdd , 0xc3 , 0xa3 , 0xc9 , 0xec , 0xd9 , 0xc0 , 0x54 , 0xbd , 0xf2 , 0x77 , 0x00 , 0x5e , 0x18 ,
0x8c , 0x0a , 0x63 , 0xdf , 0x8f , 0xf9 , 0x1e , 0x45 , 0x1c , 0xd1 , 0xf7 , 0x11 , 0x1e , 0xbd , 0x20 , 0x30 ,
0x1c , 0x27 , 0x45 , 0xfe , 0xb7 , 0xe6 , 0x93 , 0xae , 0x2a , 0xc1 , 0xdc , 0xe2 , 0xf6 , 0xd1 , 0x54 , 0x42 ,
0xa3 , 0x26 , 0x79 , 0xd6 , 0xb3 , 0x5c , 0xb0 , 0xd2 , 0x97 , 0x3e , 0xc0 , 0x0e , 0xce , 0xf4 , 0x82 , 0x42 ,
0x99 , 0x49 , 0xb7 , 0xad , 0x33 , 0xd6 , 0x67 , 0x81 , 0xaf , 0x40 , 0xa2 , 0xbd , 0x71 , 0x7e , 0x82 , 0x66 ,
0x8d , 0x97 , 0x3b , 0x9d , 0x30 , 0xe8 , 0x4b , 0x4d , 0xcd , 0xf0 , 0x1e , 0xfb , 0x33 , 0xbd , 0xcd , 0xb2 ,
0xca , 0x7e , 0x5d , 0xa2 , 0xe5 , 0x6a , 0xa1 , 0xc0 , 0xbd , 0xae , 0x8c , 0x65 , 0x93 , 0x9d , 0x53 , 0x6f ,
0x8d , 0xce , 0x4f , 0xc2 , 0xb1 , 0x54 , 0x7d , 0x7a , 0x59 , 0x08 , 0xc0 , 0xaa , 0xfc , 0x12 , 0xa9 , 0x41 ,
0x9b , 0x11 , 0x3c , 0x24 , 0x3a , 0x89 , 0x8f , 0x2f , 0x5a , 0x49 , 0x44 , 0x64 , 0x83 , 0x17 , 0xbe , 0xa2 ,
0xff , 0x6f , 0xcb , 0x65 , 0x04 , 0x6f , 0x75 , 0x4c , 0x5d , 0x15 , 0x06 , 0x7b , 0x3b , 0x3e , 0xc1 , 0xed ,
0xcb , 0xdc , 0xde , 0x04 , 0x03 , 0x30 , 0x74 , 0xc2 , 0x6b , 0x50 , 0x53 , 0x6b , 0x8c , 0xcd , 0x1b , 0xe7 ,
0xd5 , 0xf8 , 0x42 , 0xe5 , 0x07 , 0x16 , 0xc3 , 0x70 , 0x83 , 0x49 , 0x25 , 0xa4 , 0x1e , 0x61 , 0xa8 , 0xc4 ,
0x13 , 0x82 , 0xfe , 0x56 , 0xd7 , 0x04 , 0xbe , 0x4d , 0x59 , 0x05 , 0xb8 , 0x35 , 0xcc , 0xd2 , 0xaf , 0x40 ,
0x24 , 0xf3 , 0xbc , 0x48 , 0x58 , 0x0e , 0x01 , 0xe6 , 0x47 , 0x19 , 0x9d , 0xb6 , 0xe3 , 0x6f , 0x17 , 0x5e ,
0xab , 0x6c , 0xa3 , 0x5a , 0x9a , 0xdd , 0x95 , 0x2a , 0x18 , 0x22 , 0x42 , 0x36 , 0x07 , 0xa0 , 0x47 , 0xb1 ,
0x2e , 0x8f , 0xc8 , 0x78 , 0xcc , 0x7d , 0x16 , 0x61 , 0x5f , 0x34 , 0x66 , 0xee , 0x01 , 0x17 , 0x60 , 0xa3 ,
0x3f , 0x4d , 0xb1 , 0xcc , 0xcc , 0x13 , 0x99 , 0x51 , 0x3e , 0x78 , 0x69 , 0x7b , 0x83 , 0x49 , 0x5f , 0xf3 ,
0x89 , 0xa9 , 0x9e , 0x24 , 0x18 , 0x08 , 0x4d , 0xdb , 0x8a , 0xb1 , 0xd8 , 0xd7 , 0xae , 0x30 , 0x82 , 0x4d ,
0x3d , 0x4f , 0xce , 0xbe , 0x17 , 0xe5 , 0x47 , 0x5d , 0xa6 , 0x03 , 0x8c , 0xae , 0xe7 , 0xa2 , 0x63 , 0xf3 ,
0xe8 , 0x88 , 0x21 , 0xf4 , 0xfd , 0xa9 , 0x32 , 0x15 , 0x93 , 0x0c , 0xbe , 0x61 , 0xe8 , 0x35 , 0x6c , 0xb5 ,
0xc9 , 0xa9 , 0xec , 0x1c , 0x7f , 0x34 , 0x5b , 0xb0 , 0x80 , 0x6d , 0x0a , 0x52 , 0x87 , 0x74 , 0x12 , 0x90 ,
0x3a , 0xf7 , 0x40 , 0x41 , 0xe1 , 0x62 , 0xa5 , 0xb7 , 0xf0 , 0x5d , 0x45 , 0x3e , 0x55 , 0x1a , 0x30 , 0xec ,
0x5d , 0x52 , 0x00 , 0x76 , 0x38 , 0x10 , 0x0d , 0xf0 , 0x2f , 0x7f , 0xf2 , 0x3e , 0x34 , 0x1f , 0x1a , 0xd9 ,
0xf8 , 0xb9 , 0x86 , 0xf9 , 0xdc , 0x05 , 0xe0 , 0xcf , 0x28 , 0x49 , 0xfd , 0x21 , 0x64 , 0xf6 , 0xa1 , 0xc4 ,
0xf7 , 0xce , 0x91 , 0xb2 , 0x15 , 0xdf , 0x82 , 0x39 , 0x30 , 0x60 , 0xf3 , 0xd1 , 0xa6 , 0x18 , 0xc4 , 0x3b ,
0xf7 , 0xd2 , 0x64 , 0xe8 , 0xab , 0x67 , 0x23 , 0xb8 , 0x2c , 0x57 , 0x84 , 0x17 , 0xc0 , 0x2c , 0x21 , 0xfc ,
0x55 , 0x8b , 0xb6 , 0x06 , 0xbf , 0x79 , 0x7e , 0x29 , 0x5a , 0xfb , 0x5c , 0xa5 , 0x5a , 0xe4 , 0x46 , 0xac ,
0x16 , 0x8e , 0xf4 , 0x03 , 0xb7 , 0xbb , 0xb0 , 0x7b , 0xbf , 0xd3 , 0x84 , 0xbe , 0xb5 , 0x6a , 0xc8 , 0x28 ,
0xe8 , 0x2c , 0x2d , 0x0b , 0x7d , 0x0a , 0x65 , 0xd3 , 0xee , 0x54 , 0x8c , 0xbf , 0xd9 , 0xda , 0x84 , 0x21 ,
0x80 , 0x07 , 0x68 , 0x09 , 0x75 , 0xbd , 0xa8 , 0xd0 , 0xbf , 0xa0 , 0xf3 , 0xc7 , 0xc5 , 0xb5 , 0xf2 , 0xf8 ,
0xf1 , 0x74 , 0x6e , 0x7d , 0xad , 0x80 , 0xbd , 0x87 , 0xe9 , 0x83 , 0x2e , 0xda , 0x61 , 0x28 , 0x03 , 0x74 ,
0xe5 , 0x45 , 0x74 , 0x0d , 0x1f , 0x47 , 0x46 , 0x10 , 0x7f , 0xef , 0x12 , 0x9f , 0x78 , 0xec , 0x03 , 0xed ,
0x22 , 0x86 , 0x6f , 0x1a , 0x31 , 0x14 , 0xf4 , 0x3a , 0x7f , 0xef , 0x98 , 0x3e , 0x64 , 0x86 , 0xb9 , 0x0e ,
0x5b , 0x0d , 0x55 , 0xba , 0xcc , 0x6d , 0x04 , 0xc7 , 0x9c , 0x1e , 0xd4 , 0xf7 , 0xf0 , 0x60 , 0x6d , 0x54 ,
0x75 , 0x70 , 0x3b , 0x99 , 0xd3 , 0x01 , 0x9f , 0x34 , 0x44 , 0x98 , 0xab , 0xd1 , 0x6b , 0xc8 , 0xaa , 0xfd ,
0xd9 , 0x5a , 0xd3 , 0xee , 0x5d , 0x2c , 0x54 , 0x38 , 0x06 , 0x1f , 0x93 , 0xb3 , 0x5c , 0x87 , 0x10 , 0x5e ,
0xcb , 0xcd , 0xd3 , 0x4a , 0x89 , 0xd2 , 0x0d , 0xac , 0xeb , 0x42 , 0x67 , 0x2b , 0xd1 , 0x75 , 0x12 , 0x58 ,
0xdd , 0x19 , 0xe3 , 0x21 , 0x33 , 0x75 , 0xf6 , 0x51 , 0x25 , 0xeb , 0xa6 , 0x43 , 0x44 , 0x82 , 0x64 , 0xae ,
0xb8 , 0x97 , 0x01 , 0xff , 0x17 , 0x8f , 0xce , 0x96 , 0xc8 , 0xc3 , 0x86 , 0xa0 , 0x05 , 0xb2 , 0x2c , 0x33 ,
0x01 , 0x27 , 0x25 , 0x84 , 0x83 , 0x85 , 0x33 , 0xe2 , 0xd0 , 0xc5 , 0x65 , 0x89 , 0x85 , 0x45 , 0x81 , 0x3f ,
0x2d , 0xb4 , 0xb1 , 0x8b , 0x1d , 0x04 , 0x5d , 0x4c , 0xd8 , 0x46 , 0x8a , 0x04 , 0x3a , 0x3b , 0xa7 , 0x76 ,
0x47 , 0x5e , 0xcc , 0xc0 , 0x16 , 0xb2 , 0x3a , 0x38 , 0x9a , 0x6a , 0x50 , 0x3a , 0x8b , 0x82 , 0xb7 , 0x6b ,
0xf2 , 0x60 , 0x53 , 0x4e , 0xdf , 0x8a , 0x02 , 0x9f , 0xc6 , 0x27 , 0x4f , 0xf5 , 0x2a , 0xf1 , 0xf1 , 0x2f ,
0x4a , 0xaa , 0xc7 , 0x94 , 0xc0 , 0xdc , 0xdb , 0x8c , 0x41 , 0xd9 , 0x16 , 0x13 , 0xa2 , 0xae , 0x37 , 0x2a ,
0x7e , 0x26 , 0x6f , 0xdf , 0x46 , 0x07 , 0x74 , 0x88 , 0x62 , 0xab , 0x28 , 0x64 , 0x12 , 0x7c , 0xca , 0xd5 ,
0xbb , 0x6f , 0x7f , 0x3b , 0x44 , 0x99 , 0x20 , 0x93 , 0x9a , 0xa0 , 0xac , 0x17 , 0xed , 0x82 , 0xf9 , 0x43 ,
0xc2 , 0x98 , 0x6b , 0xcf , 0x54 , 0x91 , 0xfe , 0x3c , 0x9e , 0xfa , 0x7b , 0x57 , 0x38 , 0xe2 , 0x64 , 0x58 ,
0x9c , 0xe0 , 0x41 , 0x95 , 0x8a , 0xa0 , 0xa3 , 0x3d , 0x7b , 0x3e , 0x99 , 0xea , 0xc7 , 0xec , 0x82 , 0xc8 ,
0xa8 , 0xae , 0xbd , 0xf9 , 0x5c , 0x7e , 0xa2 , 0x20 , 0x78 , 0xce , 0x4a , 0x6c , 0x74 , 0x2a , 0xe7 , 0x31 ,
0xdb , 0xc1 , 0x02 , 0x49 , 0x4b , 0x83 , 0x0b , 0x0e , 0x7e , 0xeb , 0x69 , 0x59 , 0xf9 , 0x3c , 0x13 , 0x47 ,
0xaf , 0xbd , 0x58 , 0xec , 0x7f , 0xae , 0x7e , 0x4b , 0xf3 , 0x3d , 0x18 , 0xbf , 0xb0 , 0x79 , 0x92 , 0x59 ,
0x9e , 0x5f , 0x03 , 0x30 , 0x15 , 0xba , 0xec , 0xd1 , 0xaf , 0x2e , 0xf7 , 0x88 , 0xde , 0x50 , 0xae , 0x9e ,
0x59 , 0x14 , 0xf3 , 0xa5 , 0x78 , 0x25 , 0xd7 , 0xd9 , 0x1a , 0x33 , 0x81 , 0x29 , 0x8b , 0x93 , 0xf6 , 0xfa ,
0x90 , 0x3d , 0x13 , 0xaa , 0x0d , 0xa7 , 0x8e , 0x79 , 0xc0 , 0x36 , 0x45 , 0x29 , 0xa5 , 0xf1 , 0xfe , 0x92 ,
0x1b , 0x57 , 0x42 , 0x58 , 0xe0 , 0x85 , 0x15 , 0xa2 , 0xc9 , 0xb1 , 0x50 , 0x08 , 0x6a , 0x02 , 0x46 , 0xc6 ,
0x1d , 0xd0 , 0xf0 , 0xb4 , 0x5a , 0xcc , 0xd5 , 0x54 , 0x9d , 0xab , 0x13 , 0x47 , 0x9f , 0x82 , 0x60 , 0x9b ,
0x11 , 0x64 , 0x35 , 0xfa , 0xef , 0x89 , 0xb4 , 0x87 , 0x43 , 0x48 , 0x6e , 0x78 , 0x64 , 0x01 , 0xbe , 0x09 ,
0xd1 , 0xd0 , 0x40 , 0xdf , 0x77 , 0x6b , 0xee , 0x92 , 0xc5 , 0xff , 0x77 , 0xcf , 0x20 , 0x95 , 0x36 , 0x78 ,
0x35 , 0x1f , 0x1e , 0xaf , 0x4b , 0xa7 , 0x66 , 0x71 , 0x9d , 0x5e , 0xb7 , 0xd9 , 0x70 , 0x6e , 0xaa , 0x35 ,
0x49 , 0x3c , 0x9a , 0x23 , 0x53 , 0xaf , 0x3e , 0x9d , 0x60 , 0x72 , 0xb5 , 0x27 , 0x33 , 0x80 , 0x33 , 0xd2 ,
0x11 , 0x4b , 0xff , 0xfb , 0x53 , 0xab , 0x14 , 0x4c , 0xe4 , 0xe7 , 0xbc , 0x2f , 0x5c , 0xd8 , 0xbf , 0x81 ,
0x5c , 0xf7 , 0x4d , 0x5d , 0xb8 , 0x84 , 0x62 , 0xf3 , 0xd2 , 0x0a , 0x53 , 0x66 , 0xd3 , 0x13 , 0xff , 0xb0 ,
0xeb , 0x4b , 0x1f , 0x10 , 0x1d , 0xa9 , 0xba , 0x5c , 0xad , 0xe2 , 0x52 , 0x91 , 0xae , 0xbe , 0x5d , 0x05 ,
0x54 , 0x6d , 0x72 , 0x1e , 0xc1 , 0x14 , 0xb5 , 0x9b , 0x22 , 0x3f , 0x78 , 0x73 , 0x5e , 0x99 , 0x50 , 0xde ,
0xa8 , 0x41 , 0x31 , 0xd0 , 0x44 , 0xf3 , 0x2f , 0x31 , 0xd9 , 0x0b , 0x72 , 0x1a , 0xd3 , 0x70 , 0xbe , 0x84 ,
0xfc , 0xe1 , 0xed , 0x15 , 0xb9 , 0xe9 , 0x69 , 0xe2 , 0xbe , 0x50 , 0xa2 , 0xda , 0x4e , 0x7a , 0x83 , 0xc5 ,
0x56 , 0xea , 0xaf , 0x2c , 0xc9 , 0x8f , 0xcc , 0x83 , 0x1a , 0xa5 , 0x0e , 0x74 , 0xaa , 0x64 , 0x96 , 0xb5 ,
0x5a , 0x4a , 0x72 , 0xad , 0x86 , 0x5a , 0xb8 , 0x5a , 0x04 , 0x0d , 0x68 , 0x21 , 0x63 , 0x23 , 0x7b , 0x17 ,
0x9d , 0xfd , 0x1b , 0x3f , 0xac , 0x80 , 0x98 , 0x97 , 0xb5 , 0xd4 , 0xb7 , 0x08 , 0x50 , 0xf4 , 0x18 , 0xf9 ,
0x16 , 0xb1 , 0x57 , 0xfa , 0xff , 0xa8 , 0x02 , 0x6e , 0x62 , 0x7b , 0x15 , 0x8d , 0xc0 , 0x17 , 0xdd , 0xa3 ,
0x45 , 0x98 , 0x5a , 0xa0 , 0xda , 0xe2 , 0xd1 , 0x17 , 0x91 , 0x3d , 0xda , 0x18 , 0x16 , 0x19 , 0x3a , 0xfb ,
0xfd , 0x44 , 0x72 , 0x03 , 0x97 , 0x72 , 0x1d , 0xbf , 0x11 , 0xca , 0x95 , 0x05 , 0x6a , 0x9e , 0x41 , 0x3d ,
0x85 , 0xb4 , 0xd9 , 0xb3 , 0x88 , 0xd4 , 0xd9 , 0xfb , 0x1c , 0xd2 , 0x35 , 0x31 , 0x12 , 0xcc , 0xf3 , 0x03 ,
0x50 , 0x8a , 0xfb , 0x0e , 0x72 , 0xeb , 0x86 , 0x65 , 0xd5 , 0x96 , 0x0f , 0x53 , 0x1e , 0x13 , 0x99 , 0x91 ,
0xa7 , 0x70 , 0xab , 0x4c , 0xa6 , 0x1a , 0xb7 , 0x0d , 0x71 , 0x0e , 0xb6 , 0x17 , 0x85 , 0xdf , 0x9b , 0x74 ,
0x19 , 0x4a , 0xc7 , 0x55 , 0x0e , 0xe9 , 0x22 , 0x6b , 0x8e , 0xa8 , 0x5e , 0x45 , 0xc4 , 0x0f , 0x36 , 0xbb ,
0x21 , 0xda , 0x97 , 0xcf , 0xed , 0x41 , 0xb5 , 0x00 , 0x26 , 0xb1 , 0x70 , 0x43 , 0x5c , 0x60 , 0x59 , 0x23 ,
0x19 , 0xc5 , 0xdb , 0x49 , 0xef , 0xdd , 0x5d , 0x19 , 0x5f , 0x58 , 0xaa , 0x20 , 0xd9 , 0x09 , 0x17 , 0x09 ,
0xc7 , 0x5f , 0xb9 , 0x65 , 0x8f , 0x0a , 0xe8 , 0x4d , 0x7d , 0x60 , 0x88 , 0x7a , 0x53 , 0x9e , 0xf1 , 0x25 ,
0xcd , 0xa1 , 0x3e , 0xc6 , 0xc5 , 0x86 , 0xf2 , 0xee , 0x60 , 0x0f , 0x11 , 0x3e , 0xe3 , 0x90 , 0x4d , 0xff ,
0x49 , 0x0b , 0x2f , 0x85 , 0x7f , 0x18 , 0x53 , 0x4e , 0xe2 , 0x5c , 0x06 , 0x61 , 0x51 , 0x08 , 0xca , 0x55 ,
0x80 , 0x83 , 0xa4 , 0x80 , 0x05 , 0x26 , 0xe7 , 0x29 , 0xdb , 0xab , 0x94 , 0x66 , 0xe9 , 0xbf , 0xf8 , 0xd2 ,
0x79 , 0x71 , 0x61 , 0x05 , 0x33 , 0xc8 , 0x6b , 0x5c , 0x62 , 0x01 , 0x7f , 0x82 , 0xef , 0x5f , 0xa3 , 0xf6 ,
0x29 , 0x86 , 0xb6 , 0x0a , 0xa5 , 0xed , 0x3a , 0xae , 0x34 , 0x12 , 0xba , 0xb0 , 0x80 , 0xd4 , 0x53 , 0x79 ,
0x57 , 0x7d , 0xa2 , 0x38 , 0xfd , 0x39 , 0xc1 , 0xaf , 0x07 , 0x8d , 0x23 , 0x6b , 0xcd , 0x97 , 0xe0 , 0xf6 ,
0x83 , 0x74 , 0x7c , 0x3c , 0x95 , 0xdb , 0xb1 , 0xf0 , 0xf7 , 0x9e , 0xe9 , 0xe4 , 0x68 , 0x67 , 0x18 , 0x0e ,
0x00 , 0x12 , 0x70 , 0x79 , 0xc2 , 0xfe , 0xde , 0x00 , 0x12 , 0x87 , 0x00 , 0xd3 , 0x8a , 0xc5 , 0x1b , 0xb4 ,
0xd7 , 0x46 , 0x1d , 0x73 , 0x5c , 0x51 , 0x93 , 0x19 , 0x83 , 0x1b , 0x28 , 0xb9 , 0x70 , 0x87 , 0x20 , 0x34 ,
0xb6 , 0x7e , 0xb9 , 0x1f , 0x9d , 0x15 , 0xdb , 0xd7 , 0xfb , 0x30 , 0x92 , 0xe8 , 0x21 , 0x6c , 0x5c , 0xdb ,
0xaf , 0x5c , 0xd5 , 0xa5 , 0x76 , 0x4b , 0x5f , 0xc3 , 0xa8 , 0x73 , 0x9a , 0x42 , 0x04 , 0x21 , 0xf1 , 0x49 ,
0xbc , 0x47 , 0xa0 , 0xa7 , 0x4a , 0xda , 0x16 , 0x34 , 0xcd , 0x62 , 0xe1 , 0xe0 , 0x9a , 0x35 , 0xf2 , 0xf9 ,
0xb2 , 0x3c , 0xcf , 0xa6 , 0x4f , 0xd7 , 0x23 , 0xc2 , 0xd2 , 0xa5 , 0x5a , 0xf9 , 0xfd , 0x7d , 0x25 , 0x84 ,
0xda , 0xda , 0x66 , 0xb9 , 0x99 , 0x7f , 0xec , 0xfc , 0x82 , 0x7c , 0xea , 0x6b , 0x23 , 0x89 , 0x6e , 0xab ,
0xe9 , 0x43 , 0xcb , 0x88 , 0xcd , 0x18 , 0x6e , 0xae , 0x2d , 0xf5 , 0xc7 , 0xe3 , 0x92 , 0x55 , 0x0b , 0xc0 ,
0x4d , 0xc8 , 0xee , 0x4b , 0x7e , 0xfe , 0x84 , 0x8c , 0x32 , 0x33 , 0xc8 , 0xf1 , 0xfb , 0xd8 , 0x11 , 0x22 ,
0xd9 , 0x0d , 0x2b , 0x16 , 0x19 , 0xba , 0x65 , 0xe4 , 0x99 , 0x26 , 0x7b , 0xa7 , 0x04 , 0x11 , 0xfc , 0xb8 ,
0x05 , 0x48 , 0x36 , 0x43 , 0x82 , 0x14 , 0xb7 , 0x31 , 0x50 , 0xfd , 0x38 , 0x89 , 0xc1 , 0x36 , 0xa1 , 0xd5 ,
0x8e , 0x52 , 0x76 , 0x99 , 0xc8 , 0x38 , 0x49 , 0xb4 , 0x94 , 0x02 , 0x96 , 0x35 , 0x8c , 0xc1 , 0x9c , 0x7c ,
0x2b , 0xbe , 0x73 , 0x62 , 0x0a , 0xd3 , 0x57 , 0x3d , 0xdb , 0x81 , 0x14 , 0x7c , 0xd0 , 0x4a , 0xe5 , 0x2f ,
0x63 , 0xbd , 0xac , 0xcf , 0x83 , 0x10 , 0xfd , 0x06 , 0x54 , 0xc0 , 0x5c , 0xba , 0x96 , 0x72 , 0x0b , 0xcf ,
0x0a , 0x74 , 0xe2 , 0xbf , 0xbc , 0x1c , 0xc6 , 0xd8 , 0x9e , 0x7f , 0x5f , 0xbb , 0x00 , 0xfe , 0x2a , 0xbd ,
0x36 , 0x02 , 0x56 , 0x5b , 0xa2 , 0x30 , 0x75 , 0x44 , 0x62 , 0xf8 , 0x22 , 0x24 , 0x14 , 0x04 , 0x30 , 0x26 ,
0xe5 , 0xb4 , 0x06 , 0x3d , 0xfe , 0x5c , 0x3a , 0xc7 , 0xd8 , 0x1d , 0x1b , 0xc9 , 0x99 , 0xbb , 0xa5 , 0x2c ,
0x92 , 0x3b , 0xaa , 0x92 , 0xf2 , 0x12 , 0x59 , 0xc1 , 0xd7 , 0xec , 0xae , 0x89 , 0x45 , 0xfb , 0xe6 , 0x15 ,
0xa7 , 0xe8 , 0xad , 0x26 , 0xf9 , 0xb3 , 0xe0 , 0xd5 , 0x57 , 0xab , 0x4c , 0xab , 0xda , 0xe0 , 0xc2 , 0x9d ,
0xb1 , 0x12 , 0x6f , 0xc9 , 0x84 , 0x2b , 0x66 , 0x89 , 0x05 , 0x37 , 0x2a , 0x6b , 0x8d , 0xe8 , 0x21 , 0xa4 ,
0xbb , 0x28 , 0xc4 , 0xb4 , 0xa6 , 0x93 , 0xc2 , 0xc9 , 0x54 , 0x39 , 0x38 , 0x84 , 0xae , 0x70 , 0x9b , 0xcf ,
0xc5 , 0xc5 , 0x3c , 0x56 , 0x21 , 0xb4 , 0x95 , 0xb0 , 0xa7 , 0x2a , 0x30 , 0xd8 , 0xcb , 0x18 , 0x22 , 0x31 ,
0x59 , 0x01 , 0x62 , 0x43 , 0xe2 , 0x65 , 0xb9 , 0xf3 , 0xc6 , 0x5c , 0x9c , 0xe1 , 0xea , 0x48 , 0x6f , 0x10 ,
0xc2 , 0x27 , 0x3a , 0xd6 , 0xd1 , 0x15 , 0xeb , 0x7f , 0xc9 , 0x2b , 0x21 , 0x25 , 0xae , 0x91 , 0x34 , 0xd0 ,
0x6b , 0xfe , 0xe3 , 0x79 , 0x52 , 0xb9 , 0xb2 , 0x17 , 0xd6 , 0x6b , 0xf0 , 0xfa , 0x3f , 0x15 , 0xb5 , 0x74 ,
0x10 , 0xf9 , 0xd9 , 0xb0 , 0xc5 , 0xdb , 0x72 , 0x1a , 0x76 , 0xeb , 0x41 , 0x6f , 0xb5 , 0x9b , 0x8d , 0xb9 ,
0x8f , 0x75 , 0x6d , 0xc8 , 0x25 , 0xfa , 0xee , 0xdb , 0x1c , 0x3c , 0x01 , 0x80 , 0x38 , 0x5b , 0x83 , 0x01 ,
0xc0 , 0x02 , 0xa1 , 0x1c , 0x71 , 0xef , 0xbc , 0x58 , 0xa5 , 0xf6 , 0x49 , 0xb7 , 0xef , 0x9c , 0xa7 , 0x7d ,
0x39 , 0xcc , 0x2a , 0x0b , 0xdb , 0x78 , 0xb7 , 0x5d , 0x22 , 0x36 , 0xb1 , 0x36 , 0x72 , 0x56 , 0x62 , 0x19 ,
0xf1 , 0x5c , 0x0a , 0x63 , 0x02 , 0x6a , 0x59 , 0x8e , 0x24 , 0xb6 , 0x32 , 0x21 , 0x11 , 0x96 , 0xd2 , 0x8c ,
0xf1 , 0xaf , 0x84 , 0x3f , 0xf5 , 0x98 , 0x0d , 0x22 , 0x14 , 0x15 , 0xda , 0x9f , 0x44 , 0x0b , 0x08 , 0x33 ,
0x13 , 0x11 , 0x53 , 0x78 , 0xe1 , 0xf1 , 0x4b , 0x40 , 0x1c , 0x43 , 0x73 , 0x5d , 0x86 , 0x06 , 0xe1 , 0x02 ,
0x79 , 0x3f , 0x68 , 0x00 , 0xb7 , 0xb0 , 0xcb , 0x3b , 0x2e , 0x12 , 0x4e , 0x81 , 0x77 , 0x2a , 0xc5 , 0x74 ,
0xc4 , 0xd9 , 0xa0 , 0x1e , 0xa3 , 0x74 , 0x17 , 0x61 , 0x15 , 0xaf , 0xa7 , 0xb4 , 0x25 , 0x61 , 0x85 , 0x60 ,
0x70 , 0x85 , 0xfb , 0x43 , 0xb9 , 0x43 , 0x4f , 0x87 , 0x44 , 0x1a , 0x7b , 0xee , 0x68 , 0xbb , 0x74 , 0x99 ,
0xff , 0x81 , 0x22 , 0xb4 , 0x8d , 0x94 , 0xf0 , 0x4a , 0x3e , 0x28 , 0xf5 , 0xbd , 0x5c , 0xa1 , 0x7f , 0x5c ,
0xea , 0xe6 , 0xba , 0xf2 , 0x5d , 0x85 , 0xf2 , 0xed , 0xd7 , 0xfd , 0x93 , 0xf0 , 0xbb , 0xba , 0x86 , 0x23 ,
0xb5 , 0xee , 0xb5 , 0x5b , 0xd9 , 0x91 , 0xbf , 0xdc , 0xe3 , 0xdc , 0xbe , 0x82 , 0x92 , 0xce , 0xb4 , 0x0f ,
0xbf , 0xf1 , 0x80 , 0x0f , 0xe8 , 0xc3 , 0x04 , 0x49 , 0x3e , 0x95 , 0x72 , 0xf8 , 0x36 , 0x44 , 0xce , 0xf4 ,
0x3a , 0x6a , 0xeb , 0xdd , 0x88 , 0x28 , 0x8d , 0xf3 , 0x04 , 0x65 , 0xd8 , 0xfd , 0x9d , 0xb1 , 0x22 , 0xbd ,
0x44 , 0xe7 , 0xcf , 0x0f , 0x2f , 0xfc , 0xb6 , 0xd6 , 0x60 , 0x7a , 0x6e , 0x6a , 0x93 , 0x83 , 0xf1 , 0x86 ,
0xf4 , 0xf1 , 0x23 , 0xb2 , 0xfd , 0x4a , 0xb6 , 0xcf , 0x97 , 0x70 , 0xae , 0xa9 , 0x44 , 0x94 , 0x7a , 0x4e ,
0xf9 , 0x1e , 0xf8 , 0xdc , 0x1f , 0xf0 , 0x06 , 0x16 , 0xdf , 0x69 , 0xde , 0x70 , 0xea , 0x64 , 0x98 , 0xe6 ,
0x1f , 0x9f , 0x3a , 0xcf , 0xf6 , 0xb6 , 0x10 , 0xb1 , 0x3c , 0xd1 , 0x76 , 0x67 , 0x6c , 0xaf , 0x3c , 0x0a ,
0xc3 , 0x46 , 0x31 , 0x89 , 0xf7 , 0x7a , 0x0f , 0x9b , 0x7d , 0xd8 , 0x9a , 0x81 , 0x57 , 0x0c , 0x37 , 0xda ,
0xf7 , 0xc3 , 0xe5 , 0x4b , 0x14 , 0xe9 , 0x0e , 0x8c , 0x27 , 0xdc , 0x68 , 0xdb , 0xd8 , 0xdb , 0x8b , 0xee ,
0x4e , 0x9f , 0x93 , 0x18 , 0x4c , 0x75 , 0xec , 0x41 , 0x6f , 0xbe , 0x89 , 0xe3 , 0x77 , 0x64 , 0xbd , 0x22 ,
0xa1 , 0x0a , 0x16 , 0x93 , 0xbc , 0x7a , 0xec , 0x6e , 0x3c , 0x2d , 0x97 , 0x4a , 0xb1 , 0x7d , 0xb6 , 0xfc ,
0x01 , 0x8b , 0x87 , 0x2b , 0x60 , 0xe4 , 0x53 , 0xde , 0x72 , 0xef , 0xa5 , 0xdf , 0xeb , 0x2d , 0x3c , 0x01 ,
0xdc , 0xfd , 0xd8 , 0x3b , 0x2a , 0x16 , 0x74 , 0x1b , 0x26 , 0x40 , 0x5c , 0x4d , 0x11 , 0x7f , 0xa8 , 0x3f ,
0xc9 , 0xe8 , 0x8f , 0x6b , 0xe4 , 0x96 , 0x3f , 0x2b , 0x4e , 0xfa , 0x1f , 0xa5 , 0x73 , 0x85 , 0xbb , 0xe5 ,
0x6f , 0xd7 , 0x0c , 0xf4 , 0x46 , 0x81 , 0xfd , 0x0d , 0x0f , 0x70 , 0x3c , 0x51 , 0x46 , 0x47 , 0x5d , 0x37 ,
0x02 , 0x94 , 0x52 , 0x44 , 0x4b , 0xac , 0x30 , 0xc3 , 0x72 , 0xd1 , 0x50 , 0x5e , 0x29 , 0xa2 , 0x4a , 0xfb ,
0xbe , 0x8e , 0x60 , 0x16 , 0xb0 , 0xb1 , 0x82 , 0xd8 , 0x29 , 0xf5 , 0x3c , 0x72 , 0x3c , 0x79 , 0x9d , 0xa8 ,
0x64 , 0x15 , 0x57 , 0x7a , 0x10 , 0x0f , 0xb4 , 0xc0 , 0x02 , 0xdb , 0xc6 , 0x6c , 0x37 , 0xa1 , 0xf3 , 0x52 ,
0x5c , 0xb5 , 0xcd , 0x42 , 0xf1 , 0x43 , 0x31 , 0xfe , 0x0b , 0xaa , 0xcb , 0xd5 , 0x0a , 0xf4 , 0x69 , 0x64 ,
0xf5 , 0x98 , 0x41 , 0x53 , 0xed , 0x04 , 0x27 , 0x56 , 0x4a , 0xe9 , 0x4c , 0x96 , 0x64 , 0x29 , 0xff , 0xe2 ,
0xe1 , 0x79 , 0xf5 , 0x78 , 0x69 , 0x43 , 0xe6 , 0x4e , 0x4e , 0xa8 , 0x8a , 0x50 , 0x15 , 0x37 , 0x44 , 0x73 ,
0x41 , 0xe8 , 0x21 , 0xe4 , 0x0a , 0x2e , 0x43 , 0x2d , 0x4b , 0xd1 , 0xfe , 0xf5 , 0xc5 , 0x30 , 0x31 , 0x39 ,
0xfa , 0x53 , 0x7a , 0x3c , 0xd5 , 0x63 , 0x7a , 0x5c , 0xff , 0x18 , 0xf8 , 0x79 , 0x84 , 0x73 , 0x84 , 0x55 ,
0x61 , 0x17 , 0x2f , 0xad , 0x34 , 0xd3 , 0xf2 , 0xf3 , 0x2b , 0xe6 , 0xe3 , 0xc2 , 0x0e , 0x2b , 0x28 , 0xc4 ,
0x92 , 0xd0 , 0xd3 , 0x14 , 0x06 , 0x58 , 0xbb , 0x2f , 0xdf , 0xe6 , 0x3d , 0x0d , 0x6b , 0x71 , 0x40 , 0xc2 ,
0xbf , 0x6b , 0x41 , 0xae , 0x85 , 0x39 , 0x1c , 0xdf , 0x02 , 0xf3 , 0x6e , 0x85 , 0x15 , 0x1d , 0xb8 , 0xe4 ,
0xbe , 0x32 , 0x77 , 0x70 , 0x22 , 0x5b , 0xe7 , 0x03 , 0xd6 , 0x1c , 0xab , 0x90 , 0x9b , 0x0d , 0x03 , 0x40 ,
0x0f , 0x3d , 0x82 , 0x9b , 0xb8 , 0x32 , 0x03 , 0x99 , 0xee , 0xe4 , 0xa9 , 0x63 , 0x35 , 0xec , 0xe2 , 0x29 ,
0xb3 , 0xda , 0x4c , 0x3c , 0x4c , 0x6b , 0x4f , 0x67 , 0x0a , 0x8e , 0x35 , 0xe2 , 0xe5 , 0x3d , 0x97 , 0xe6 ,
0xec , 0xb2 , 0x99 , 0xa2 , 0x7d , 0x1c , 0xf0 , 0xb0 , 0x6d , 0xc7 , 0x14 , 0xe6 , 0xb1 , 0x77 , 0x75 , 0x2d ,
0x73 , 0x0e , 0xa6 , 0x3b , 0x4b , 0x90 , 0xac , 0xe4 , 0x34 , 0x60 , 0x6d , 0x03 , 0xba , 0xb2 , 0xb4 , 0xb8 ,
0x11 , 0xe1 , 0x1c , 0xb2 , 0x27 , 0xbb , 0x39 , 0x61 , 0x47 , 0x53 , 0x3e , 0xb0 , 0x5b , 0x0d , 0x5a , 0xc9 ,
0x36 , 0xd5 , 0xd3 , 0x99 , 0xa8 , 0xdb , 0x74 , 0x32 , 0x5b , 0x05 , 0x95 , 0x0d , 0x2f , 0x19 , 0xa7 , 0x99 ,
0x2e , 0x57 , 0x19 , 0xde , 0x4b , 0xb9 , 0x08 , 0x57 , 0xdc , 0x37 , 0x15 , 0x7d , 0x1f , 0xe5 , 0x12 , 0x33 ,
0x91 , 0xa1 , 0xdd , 0xe3 , 0x30 , 0x2b , 0x84 , 0x4c , 0xe9 , 0xbd , 0x0c , 0x8b , 0x6d , 0xe4 , 0x75 , 0x12 ,
0x41 , 0x98 , 0x4b , 0xab , 0x25 , 0xda , 0x4b , 0xc0 , 0x92 , 0xb1 , 0x4a , 0x32 , 0x06 , 0x5a , 0xac , 0x93 ,
0xf2 , 0x6f , 0x01 , 0x4d , 0xc1 , 0xac , 0xf2 , 0x37 , 0x8b , 0x4e , 0x03 , 0xbb , 0xd0 , 0x06 , 0x4f , 0xfa ,
0x7d , 0xb5 , 0xdc , 0x1e , 0xf3 , 0x2d , 0x05 , 0x29 , 0x1b , 0x7e , 0x6e , 0x0e , 0x26 , 0x3c , 0x11 , 0x5c ,
0xaf , 0x97 , 0x55 , 0x5a , 0xc9 , 0x4f , 0x75 , 0xb5 , 0x24 , 0x72 , 0xa7 , 0x07 , 0x0b , 0x02 , 0xd9 , 0xa2 ,
0xa3 , 0xb0 , 0xde , 0x30 , 0x22 , 0xfc , 0x54 , 0x14 , 0xfa , 0x7b , 0x19 , 0x58 , 0x19 , 0x59 , 0x9f , 0x7d ,
0x8a , 0x63 , 0xd7 , 0x27 , 0x66 , 0xe0 , 0x52 , 0x05 , 0x3d , 0x4e , 0x14 , 0xad , 0xf5 , 0xaa , 0xc5 , 0x79 ,
0x1a , 0x02 , 0x78 , 0x03 , 0x2c , 0xe4 , 0x86 , 0x14 , 0x51 , 0xbc , 0xc7 , 0x31 , 0x58 , 0x04 , 0x39 , 0xe9 ,
0xac , 0xae , 0xaf , 0x74 , 0x97 , 0xef , 0x9a , 0x5a , 0x97 , 0x7c , 0xf5 , 0xcd , 0xa1 , 0x19 , 0xd6 , 0x31 ,
0xc2 , 0x0b , 0x5e , 0x66 , 0x9a , 0x7f , 0x96 , 0x09 , 0x59 , 0xc5 , 0x17 , 0x5c , 0x39 , 0x66 , 0xa7 , 0x29 ,
0x31 , 0xb9 , 0x6d , 0xad , 0x4e , 0xc1 , 0x90 , 0xb9 , 0x94 , 0x02 , 0xc3 , 0xe0 , 0x69 , 0xb8 , 0x44 , 0x6b ,
0xa3 , 0xa6 , 0xab , 0x7e , 0xfe , 0xfa , 0x8f , 0x89 , 0x60 , 0xf5 , 0x7e , 0x68 , 0x62 , 0xcf , 0x58 , 0xa2 ,
0x96 , 0xca , 0xe5 , 0x36 , 0x23 , 0xd9 , 0x88 , 0x6e , 0x8b , 0x17 , 0x7e , 0xf3 , 0xe5 , 0xd7 , 0x63 , 0xb0 ,
0x96 , 0x82 , 0x18 , 0xf3 , 0x10 , 0x13 , 0x09 , 0xce , 0x7b , 0xe3 , 0xd8 , 0xb6 , 0x5b , 0x6f , 0x0e , 0x13 ,
0x1b , 0xd3 , 0x49 , 0x57 , 0x8b , 0xa1 , 0xf8 , 0xbd , 0xda , 0xed , 0x0d , 0x9c , 0x6c , 0x32 , 0x61 , 0x03 ,
0xdd , 0x39 , 0x63 , 0x9c , 0x6f , 0xe3 , 0xe5 , 0xc1 , 0xd6 , 0xdb , 0x26 , 0x1d , 0xa2 , 0x60 , 0x7e , 0x7b ,
0xb2 , 0x51 , 0x80 , 0x8f , 0x78 , 0x89 , 0x43 , 0xaa , 0x9d , 0x76 , 0xef , 0x1e , 0xdb , 0xd0 , 0x51 , 0xb4 ,
0x8e , 0xed , 0x14 , 0x42 , 0xfb , 0x63 , 0x5d , 0x21 , 0x99 , 0x30 , 0x99 , 0x05 , 0x53 , 0x25 , 0xe8 , 0xec ,
0xe7 , 0xf1 , 0x40 , 0x8c , 0xba , 0xb6 , 0x6a , 0xe0 , 0xc7 , 0x73 , 0x68 , 0x6c , 0x15 , 0x4b , 0x42 , 0xe3 ,
0xda , 0x97 , 0x0e , 0x40 , 0xc5 , 0xff , 0x98 , 0x2b , 0xf2 , 0x19 , 0xca , 0x3d , 0x49 , 0x72 , 0x7a , 0x96 ,
0xd5 , 0x16 , 0xd4 , 0x2a , 0xf4 , 0x5d , 0x1d , 0xd2 , 0x1d , 0x22 , 0x60 , 0xe0 , 0x18 , 0xf7 , 0x38 , 0x04 ,
0x01 , 0x94 , 0x45 , 0xb2 , 0x5f , 0xc0 , 0x10 , 0xce , 0x65 , 0x62 , 0x33 , 0x61 , 0x6d , 0x65 , 0x15 , 0x7d ,
0x39 , 0xc0 , 0xcf , 0xcb , 0x4c , 0xa2 , 0x23 , 0x1c , 0xa8 , 0x42 , 0x46 , 0x99 , 0x81 , 0xdc , 0x28 , 0xad ,
0xd6 , 0xcc , 0x92 , 0xdd , 0x06 , 0x58 , 0x02 , 0x0c , 0xe1 , 0x67 , 0xf2 , 0x4f , 0x7a , 0xe3 , 0xde , 0xb9 ,
0x65 , 0x81 , 0xb4 , 0x59 , 0x13 , 0xfc , 0xa4 , 0x12 , 0x13 , 0x41 , 0x9f , 0xd2 , 0xe2 , 0x9e , 0xea , 0x87 ,
0x6a , 0x95 , 0xba , 0xae , 0x27 , 0x4d , 0x12 , 0xc4 , 0x58 , 0x2a , 0x4c , 0x18 , 0x68 , 0x6b , 0x3b , 0xd6 ,
0xfa , 0xc5 , 0x47 , 0x0c , 0xfe , 0x40 , 0x66 , 0x5b , 0x0e , 0xe9 , 0xe9 , 0x01 , 0x4f , 0x1c , 0x48 , 0x52 ,
0x19 , 0xc8 , 0x9d , 0xa3 , 0xbe , 0x81 , 0x04 , 0xa1 , 0xd8 , 0x4e , 0x6f , 0x6e , 0x80 , 0xcd , 0xf7 , 0x38 ,
0x63 , 0x16 , 0x1f , 0x27 , 0x4e , 0x5e , 0x4a , 0xcb , 0xc8 , 0x15 , 0x62 , 0x15 , 0x9e , 0x4e , 0xbc , 0xfc ,
0xa3 , 0x26 , 0x85 , 0x54 , 0xe0 , 0x56 , 0xb9 , 0xef , 0xc0 , 0x6c , 0x42 , 0x87 , 0x35 , 0x9a , 0x28 , 0xc1 ,
0x90 , 0x2c , 0xa2 , 0xc6 , 0xbe , 0x9e , 0xbb , 0x11 , 0x1b , 0x88 , 0xa7 , 0xea , 0x03 , 0x82 , 0x8b , 0xf5 ,
0xb5 , 0x72 , 0x76 , 0xb8 , 0x30 , 0x2d , 0x07 , 0xb3 , 0x2f , 0x35 , 0x48 , 0xf5 , 0xc5 , 0x6c , 0xd3 , 0x30 ,
0x98 , 0x55 , 0xe1 , 0x68 , 0x0d , 0x47 , 0xcf , 0xbe , 0x29 , 0x8f , 0xcf , 0x48 , 0x7b , 0x79 , 0x2d , 0xd8 ,
0xbf , 0x52 , 0xce , 0x1d , 0xdc , 0xb2 , 0x22 , 0xe6 , 0x86 , 0x30 , 0x98 , 0x50 , 0xf4 , 0x56 , 0x53 , 0x49 ,
0x38 , 0x5f , 0x6d , 0xce , 0xe9 , 0x35 , 0x2f , 0xcf , 0x44 , 0x8a , 0x96 , 0xe5 , 0x0a , 0xd8 , 0x62 , 0x64 ,
0x1b , 0xfe , 0x38 , 0x83 , 0x36 , 0x60 , 0xd4 , 0x31 , 0xa4 , 0x63 , 0x4a , 0xd7 , 0xa0 , 0x9b , 0x1a , 0xca ,
0x84 , 0xaa , 0x30 , 0xba , 0xea , 0xcc , 0x48 , 0xb2 , 0xb0 , 0x51 , 0xc5 , 0x0e , 0xd6 , 0x3b , 0x1b , 0xab ,
0x20 , 0x4a , 0xd0 , 0xd9 , 0xc8 , 0xf3 , 0x19 , 0x63 , 0x07 , 0x10 , 0x7c , 0xcd , 0xa6 , 0x5a , 0xa5 , 0xcd ,
0x3b , 0x8e , 0x09 , 0x7f , 0xf0 , 0x54 , 0xba , 0xc8 , 0x2a , 0xbb , 0x1d , 0x0d , 0x76 , 0xdd , 0xb1 , 0x47 ,
0xed , 0xb9 , 0x41 , 0x25 , 0x43 , 0x97 , 0x2d , 0x27 , 0xc0 , 0x89 , 0x81 , 0x69 , 0xfb , 0x02 , 0x21 , 0xd3 ,
0xc6 , 0x59 , 0x65 , 0x11 , 0x42 , 0xbc , 0x88 , 0x98 , 0xa0 , 0x0a , 0xa1 , 0xdc , 0xb1 , 0xb7 , 0x03 , 0xc1 ,
0x64 , 0x8f , 0x95 , 0xb3 , 0x37 , 0x67 , 0x87 , 0x5f , 0xe5 , 0xf1 , 0x93 , 0x27 , 0xe7 , 0x12 , 0x62 , 0x5e ,
0x87 , 0x52 , 0x4b , 0x44 , 0x5f , 0xe5 , 0x45 , 0x58 , 0xc0 , 0xfb , 0x06 , 0xbc , 0x8a , 0xe0 , 0xd4 , 0xe5 ,
0x9f , 0xf3 , 0x2c , 0x20 , 0x30 , 0x64 , 0xfe , 0x46 , 0xf5 , 0xf3 , 0xda , 0x53 , 0x42 , 0x8f , 0x99 , 0x7d ,
0xfb , 0x47 , 0xb7 , 0x4a , 0xbe , 0x66 , 0xf6 , 0xe1 , 0x2e , 0x62 , 0x87 , 0x26 , 0xce , 0x02 , 0x9a , 0xe2 ,
0xeb , 0xca , 0x64 , 0xc4 , 0xaa , 0x0d , 0xbc , 0x9b , 0x1e , 0x32 , 0xc3 , 0xf8 , 0xec , 0xaf , 0x1b , 0xdb ,
0xff , 0x0c , 0x71 , 0x69 , 0xc6 , 0xb2 , 0xc0 , 0x3a , 0x66 , 0xee , 0xd2 , 0xc9 , 0x16 , 0x4d , 0xaf , 0x24 ,
0xfa , 0x65 , 0x18 , 0x75 , 0xfb , 0x45 , 0x25 , 0xa6 , 0x26 , 0xfb , 0x66 , 0x2a , 0x15 , 0x9c , 0x85 , 0xf4 ,
0xda , 0x1d , 0x4f , 0x3b , 0xe2 , 0x4d , 0x23 , 0xeb , 0x8c , 0x57 , 0xb1 , 0xb5 , 0x4c , 0x90 , 0x23 , 0x7f ,
0x01 , 0xfa , 0x06 , 0x9d , 0x35 , 0x4c , 0x6a , 0xb5 , 0x79 , 0xb9 , 0x00 , 0x17 , 0x46 , 0x46 , 0x54 , 0x45 ,
0x60 , 0xed , 0xe8 , 0x86 , 0xc3 , 0xde , 0x65 , 0xdf , 0x5b , 0x40 , 0x97 , 0xcd , 0x77 , 0x25 , 0x41 , 0xcd ,
0xf2 , 0x89 , 0xbf , 0xfe , 0x55 , 0xa1 , 0xf9 , 0xf5 , 0x7a , 0x18 , 0x2d , 0x6c , 0xec , 0x28 , 0xed , 0xd1 ,
0x44 , 0xa1 , 0x98 , 0x77 , 0x73 , 0x6f , 0xc0 , 0x4c , 0x7f , 0x05 , 0xc0 , 0x9c , 0x19 , 0xed , 0x90 , 0x3c ,
0x56 , 0xb6 , 0xf4 , 0x86 , 0x2f , 0x60 , 0xb3 , 0x1b , 0x95 , 0x58 , 0x26 , 0x40 , 0xc2 , 0xc0 , 0xda , 0x24 ,
0x26 , 0xcb , 0x06 , 0x26 , 0x53 , 0x30 , 0x12 , 0x35 , 0x0b , 0xe5 , 0x39 , 0x80 , 0x3a , 0xf7 , 0xd5 , 0xae ,
0xb8 , 0xcb , 0xea , 0xf6 , 0x4c , 0x3d , 0x81 , 0xb4 , 0x1f , 0x97 , 0x88 , 0x2c , 0x9f , 0x9c , 0x70 , 0x70 ,
0xd5 , 0x34 , 0xe8 , 0x65 , 0xb7 , 0xdb , 0xb3 , 0x33 , 0x26 , 0xcf , 0x95 , 0xa3 , 0x31 , 0x6a , 0x90 , 0x9f ,
0xde , 0xd3 , 0x17 , 0x8a , 0x24 , 0xdc , 0xe1 , 0x57 , 0xb8 , 0x28 , 0x70 , 0x79 , 0x52 , 0xd7 , 0x9d , 0x6b ,
0x99 , 0xbb , 0xf7 , 0x14 , 0x5e , 0xc0 , 0x05 , 0xff , 0xbc , 0x82 , 0xc2 , 0x20 , 0x57 , 0x6c , 0xbe , 0xbe ,
0x71 , 0xf7 , 0xdb , 0x24 , 0xc3 , 0x33 , 0xe6 , 0x26 , 0x50 , 0x9a , 0xfc , 0xd6 , 0x35 , 0xb7 , 0x42 , 0xc4 ,
0x63 , 0x22 , 0x3d , 0x4c , 0x52 , 0x1b , 0xf3 , 0x6a , 0x38 , 0x5c , 0x9b , 0xf5 , 0x9b , 0xfb , 0x5f , 0x0b ,
0x37 , 0x9a , 0xf2 , 0x25 , 0xd3 , 0xd9 , 0xa7 , 0xc5 , 0x02 , 0x0f , 0x86 , 0xaa , 0xee , 0x71 , 0x49 , 0xa2 ,
0x22 , 0xc2 , 0x9d , 0x92 , 0xc2 , 0x3e , 0x8f , 0x26 , 0x7f , 0x5c , 0x23 , 0x62 , 0xe4 , 0xb5 , 0xf5 , 0x9e ,
0xea , 0x2f , 0xbc , 0xe8 , 0x4b , 0x4d , 0xd1 , 0xbd , 0x2e , 0x39 , 0x04 , 0x56 , 0xfc , 0x0f , 0xd3 , 0xd6 ,
0x10 , 0x16 , 0xe5 , 0x02 , 0x11 , 0x5c , 0xbc , 0x66 , 0x90 , 0xf1 , 0xb7 , 0xf6 , 0x4f , 0x56 , 0x0f , 0x87 ,
0x2c , 0xa8 , 0xb6 , 0xa9 , 0x30 , 0xf6 , 0x17 , 0x1b , 0xda , 0x2c , 0x2a , 0x75 , 0x09 , 0xcc , 0x32 , 0xe2 ,
0x77 , 0xc8 , 0xd8 , 0x98 , 0x7b , 0xd4 , 0x8a , 0x73 , 0xda , 0xe2 , 0x76 , 0x78 , 0x04 , 0x82 , 0xab , 0x11 ,
0x71 , 0xe3 , 0x73 , 0x79 , 0x5e , 0xdb , 0x86 , 0x79 , 0x52 , 0x1d , 0x28 , 0xc1 , 0x87 , 0xa8 , 0x2f , 0xca ,
0xbc , 0xb9 , 0xba , 0x58 , 0x4e , 0xb3 , 0x89 , 0x4d , 0x74 , 0x88 , 0x37 , 0x36 , 0xbb , 0x1d , 0x1d , 0xe8 ,
0xc9 , 0xd4 , 0xe8 , 0xa4 , 0x31 , 0x17 , 0x56 , 0xf4 , 0x72 , 0xc0 , 0x00 , 0x58 , 0x1c , 0x76 , 0xab , 0x2d ,
0x75 , 0xe6 , 0x90 , 0x85 , 0xbf , 0xdc , 0x57 , 0x2f , 0xbe , 0xb1 , 0xa9 , 0x3c , 0xd1 , 0xf6 , 0x58 , 0x80 ,
0xcf , 0x43 , 0x60 , 0xb4 , 0x1b , 0x82 , 0x02 , 0x90 , 0x3c , 0xad , 0xfc , 0xef , 0xc4 , 0xce , 0x9a , 0xec ,
0xea , 0x26 , 0x57 , 0xb9 , 0x7e , 0xf7 , 0x69 , 0xa3 , 0x06 , 0x52 , 0xc2 , 0x51 , 0x83 , 0x8f , 0xf4 , 0x0d ,
0xb7 , 0xa3 , 0xfc , 0xae , 0x29 , 0x81 , 0xcc , 0xdc , 0xbb , 0x2d , 0xed , 0x38 , 0xf4 , 0x40 , 0x7a , 0x16 ,
0x56 , 0x11 , 0x7f , 0x33 , 0x50 , 0x44 , 0xc0 , 0xb9 , 0x77 , 0x66 , 0x6b , 0xce , 0x18 , 0xd6 , 0xdf , 0x39 ,
0x9e , 0xa6 , 0xa1 , 0xbd , 0xed , 0x0e , 0xd7 , 0x14 , 0xe1 , 0xb9 , 0x6a , 0x51 , 0x4b , 0x5c , 0x00 , 0xdc ,
0xd7 , 0xdb , 0x76 , 0x69 , 0xef , 0xfa , 0x2e , 0xcf , 0x4f , 0xa8 , 0x2e , 0x59 , 0x26 , 0xa0 , 0x55 , 0x7e ,
0x9b , 0x55 , 0xfc , 0x7c , 0x32 , 0xff , 0xbf , 0x08 , 0x90 , 0xb5 , 0x7a , 0x4f , 0xf2 , 0x26 , 0x05 , 0x85 ,
0xf6 , 0x56 , 0x7b , 0x56 , 0x41 , 0xdc , 0x95 , 0xcf , 0x03 , 0x45 , 0xef , 0x78 , 0x34 , 0x30 , 0x61 , 0x9a ,
0x44 , 0x8f , 0xbc , 0xb5 , 0x5c , 0xf4 , 0x64 , 0x2c , 0x13 , 0x21 , 0x3c , 0xa5 , 0x1b , 0xe7 , 0x9c , 0x60 ,
0x9b , 0x49 , 0xe1 , 0x34 , 0x8a , 0xef , 0x72 , 0xa7 , 0xa9 , 0x71 , 0x6f , 0x32 , 0x52 , 0x64 , 0x0a , 0xa0 ,
0x4a , 0xf3 , 0xa2 , 0xee , 0x16 , 0x1a , 0xbe , 0x93 , 0x0a , 0xa2 , 0xd8 , 0xb0 , 0x82 , 0x3b , 0x4d , 0x7d ,
0x24 , 0xe2 , 0x09 , 0xef , 0x6b , 0xdd , 0x92 , 0x00 , 0x6f , 0x76 , 0xd1 , 0x41 , 0xde , 0xdb , 0xab , 0x6c ,
0x39 , 0x4d , 0x26 , 0x54 , 0xb4 , 0x56 , 0xce , 0x4c , 0x19 , 0x95 , 0x2a , 0x51 , 0xa9 , 0xf1 , 0xad , 0x58 ,
0xf8 , 0x6d , 0xeb , 0x32 , 0xc2 , 0x30 , 0x03 , 0x15 , 0x0e , 0x9d , 0x76 , 0x74 , 0x5d , 0xe0 , 0x62 , 0xd9 ,
0xc3 , 0x83 , 0xe4 , 0xd5 , 0x33 , 0x1d , 0x7b , 0xfe , 0x6f , 0x16 , 0x5c , 0xaf , 0x34 , 0xe9 , 0x2c , 0x20 ,
0xca , 0x99 , 0xac , 0x57 , 0x47 , 0x81 , 0x0d , 0x57 , 0x65 , 0x33 , 0x1a , 0x5b , 0x0c , 0xaa , 0x13 , 0x00 ,
0xf9 , 0x3d , 0x02 , 0x2c , 0xc1 , 0x23 , 0x7d , 0x55 , 0x47 , 0xdb , 0x8b , 0xcb , 0x50 , 0xc1 , 0xd2 , 0x95 ,
0xff , 0x0b , 0x8a , 0xb3 , 0x38 , 0x43 , 0x51 , 0xe1 , 0x3b , 0x3b , 0xc3 , 0x4b , 0x5e , 0xc9 , 0xac , 0x0f ,
0xb3 , 0x81 , 0x32 , 0xf1 , 0x2e , 0xa2 , 0x51 , 0xea , 0xb2 , 0x85 , 0x1a , 0x48 , 0xee , 0x35 , 0xa0 , 0x86 ,
0x05 , 0x14 , 0x05 , 0xc3 , 0xf5 , 0xe2 , 0xa1 , 0xdf , 0x47 , 0xb0 , 0xe2 , 0x04 , 0x21 , 0x85 , 0xbd , 0x0b ,
0x00 , 0x98 , 0xe4 , 0xdb , 0xe1 , 0x7a , 0xf7 , 0xfd , 0x7a , 0x92 , 0x45 , 0x15 , 0x57 , 0xd7 , 0xcf , 0x18 ,
0xb7 , 0xa3 , 0xf2 , 0xd5 , 0xcf , 0x18 , 0x7a , 0xe5 , 0xa4 , 0x4b , 0x0c , 0xe1 , 0x66 , 0xd9 , 0x1b , 0x3f ,
0x60 , 0x47 , 0x90 , 0xd1 , 0xe9 , 0xb8 , 0xf5 , 0xa8 , 0x36 , 0x1f , 0xab , 0x7d , 0x85 , 0x9a , 0x57 , 0xc6 ,
0xdb , 0x9c , 0xf8 , 0x90 , 0xbf , 0xc7 , 0xb7 , 0xf5 , 0xa3 , 0x1d , 0x69 , 0x6d , 0xe8 , 0xda , 0x3d , 0xa6 ,
0xaa , 0x38 , 0x55 , 0x30 , 0x9d , 0x7a , 0xc0 , 0x6d , 0x42 , 0xeb , 0xc6 , 0x97 , 0xf3 , 0x84 , 0xa1 , 0x0a ,
0x4c , 0x78 , 0xc3 , 0xdb , 0x9f , 0x29 , 0x85 , 0x08 , 0x4d , 0x8f , 0xbe , 0x8e , 0xba , 0x68 , 0x1a , 0x97 ,
0x74 , 0xa7 , 0xd2 , 0xec , 0xb9 , 0x8b , 0xbf , 0x8c , 0xd7 , 0xb6 , 0x2e , 0x3d , 0x3b , 0x7d , 0xf8 , 0x84 ,
0x2b , 0x30 , 0xe6 , 0x40 , 0x13 , 0x53 , 0xbe , 0x47 , 0xd9 , 0x14 , 0x16 , 0xdf , 0x05 , 0xeb , 0xa3 , 0x6c ,
0x74 , 0xd4 , 0xba , 0x8d , 0xf5 , 0x80 , 0xab , 0xc8 , 0x40 , 0x3c , 0xd5 , 0x00 , 0x47 , 0x86 , 0x66 , 0x73 ,
0x6b , 0x36 , 0xc5 , 0xa2 , 0x81 , 0x92 , 0xd8 , 0xfd , 0xde , 0x61 , 0x34 , 0xc3 , 0x34 , 0xaa , 0x1a , 0x40 ,
0x3c , 0x95 , 0x8f , 0x75 , 0x2f , 0xc6 , 0x22 , 0xbb , 0x45 , 0xfa , 0x68 , 0x10 , 0xd7 , 0x22 , 0x09 , 0x59 ,
0x36 , 0x25 , 0x45 , 0x06 , 0x9b , 0xa2 , 0x33 , 0xf9 , 0x34 , 0x63 , 0xe2 , 0x2b , 0x18 , 0xa7 , 0xbe , 0x25 ,
0xf2 , 0xe6 , 0x9d , 0x99 , 0x97 , 0xb1 , 0x0d , 0x64 , 0x3a , 0x53 , 0xcb , 0xe5 , 0x73 , 0xc6 , 0x47 , 0x3c ,
0x76 , 0x87 , 0xae , 0x74 , 0x1f , 0x4f , 0x84 , 0x2e , 0x4f , 0x10 , 0xda , 0x4e , 0x32 , 0x40 , 0x71 , 0xc4 ,
0xd9 , 0xac , 0x85 , 0x4c , 0x6e , 0x10 , 0x37 , 0x66 , 0xcd , 0x49 , 0x83 , 0x20 , 0xa7 , 0xe7 , 0x47 , 0x70 ,
0xaf , 0x38 , 0x6c , 0x95 , 0x32 , 0x6e , 0x7f , 0x21 , 0x9e , 0x2b , 0xbd , 0x09 , 0x6a , 0xe0 , 0xd9 , 0xdf ,
0x27 , 0x1e , 0x41 , 0x0b , 0x1a , 0xc3 , 0x6c , 0x83 , 0x9f , 0x1a , 0x57 , 0x5e , 0x94 , 0x72 , 0xc5 , 0x8d ,
0x9f , 0x61 , 0xe4 , 0x47 , 0x56 , 0xb1 , 0x80 , 0x32 , 0x3c , 0x23 , 0x4c , 0x21 , 0x0d , 0xdd , 0x4e , 0x5f ,
0x61 , 0x8a , 0xcf , 0xee , 0x59 , 0x87 , 0x36 , 0xe4 , 0x0a , 0x24 , 0x7c , 0x03 , 0xda , 0x64 , 0x76 , 0x3c ,
0x80 , 0x04 , 0x3c , 0x89 , 0x91 , 0x9e , 0x56 , 0xba , 0x66 , 0x98 , 0xb2 , 0xfc , 0x8d , 0x81 , 0xdf , 0xf4 ,
0x3c , 0x0c , 0x0c , 0x03 , 0xee , 0xd9 , 0xb4 , 0xb0 , 0x0a , 0xcf , 0x6d , 0x0b , 0xf6 , 0xe7 , 0xa6 , 0x21 ,
0x1c , 0xe7 , 0x9f , 0xa5 , 0x74 , 0xea , 0x18 , 0x3f , 0xf7 , 0x2c , 0x3c , 0x09 , 0x53 , 0xd6 , 0xcc , 0x71 ,
0xd7 , 0x07 , 0x9d , 0x3d , 0x59 , 0xb4 , 0xec , 0x86 , 0xe9 , 0x8b , 0xa0 , 0x14 , 0x99 , 0xf8 , 0xa6 , 0x9b ,
0x59 , 0xe2 , 0x6e , 0x73 , 0x78 , 0xe0 , 0xf3 , 0xcb , 0xce , 0x06 , 0xd0 , 0x1b , 0x70 , 0xd8 , 0x15 , 0xc2 ,
0xbf , 0x04 , 0xe8 , 0xcb , 0x31 , 0x1d , 0x04 , 0x9f , 0x9d , 0xf2 , 0xa1 , 0x60 , 0x1f , 0x63 , 0x49 , 0x64 ,
0x56 , 0x3e , 0xa1 , 0x64 , 0xf2 , 0xb0 , 0xaa , 0xdc , 0x5f , 0xa3 , 0x3b , 0x8d , 0x16 , 0x07 , 0xa1 , 0xf3 ,
0xec , 0xc5 , 0x7f , 0xe2 , 0x1c , 0xeb , 0xb7 , 0x81 , 0xd3 , 0xdf , 0x5f , 0xee , 0xa0 , 0xe1 , 0x82 , 0x25 ,
0x7a , 0xe2 , 0x3f , 0xce , 0x3b , 0x89 , 0x1f , 0xbe , 0x73 , 0x9e , 0xe4 , 0x46 , 0x11 , 0x39 , 0xfc , 0x6b ,
0xe6 , 0x99 , 0xd6 , 0x98 , 0x9f , 0x8f , 0x19 , 0x41 , 0x90 , 0x5d , 0xf1 , 0x85 , 0x94 , 0xe7 , 0x13 , 0x91 ,
0xe3 , 0x01 , 0xfd , 0x41 , 0x29 , 0x1d , 0xcb , 0x11 , 0x13 , 0xcd , 0x4c , 0x92 , 0x6c , 0x15 , 0x7c , 0xd1 ,
0xbc , 0x50 , 0x68 , 0x4c , 0x46 , 0xe3 , 0x0f , 0x25 , 0xd5 , 0x6c , 0x3b , 0x53 , 0x0b , 0x2f , 0x1d , 0xd2 ,
0x52 , 0xca , 0x97 , 0x29 , 0x5c , 0xdf , 0x24 , 0xa8 , 0xc6 , 0xbe , 0xd1 , 0xc1 , 0x14 , 0x20 , 0x24 , 0x4f ,
0xfa , 0xd4 , 0xe5 , 0xb0 , 0x93 , 0x45 , 0xe1 , 0xc9 , 0xf2 , 0xbe , 0x0d , 0xc2 , 0xd1 , 0x4c , 0xab , 0x2f ,
0x85 , 0xc1 , 0x0b , 0x51 , 0x40 , 0x7c , 0xdf , 0x7f , 0x74 , 0xa1 , 0x3d , 0xb8 , 0x4d , 0x4f , 0x26 , 0x24 ,
0x11 , 0x61 , 0x64 , 0xd3 , 0x0e , 0x5b , 0x29 , 0x87 , 0x05 , 0xfe , 0xb9 , 0x78 , 0xde , 0xad , 0xf9 , 0xe8 ,
0xc4 , 0x47 , 0x4d , 0xfb , 0xa8 , 0x54 , 0x99 , 0x50 , 0x1d , 0xe7 , 0xaf , 0x1a , 0x12 , 0x20 , 0x8d , 0xcd ,
0xde , 0x8e , 0xf8 , 0x26 , 0x65 , 0x8b ,
} ;
unsigned char commit_0 [ ] = {
0x09 , 0x9e , 0x56 , 0x8d , 0x5b , 0x9d , 0x2a , 0xd6 , 0x1f , 0xe0 , 0x81 , 0x21 , 0xcc , 0x15 , 0xb3 , 0x66 ,
0x6d , 0xb4 , 0xbb , 0xac , 0xdd , 0x28 , 0x08 , 0xab , 0x21 , 0x6e , 0x35 , 0xac , 0xa7 , 0xe0 , 0x0a , 0xa8 ,
0xef ,
} ;
2022-08-20 16:06:46 +00:00
CHECK ( secp256k1_pedersen_commit ( ctx , & pc , vector_blind , value , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & p_len , min_value , & pc , vector_blind , vector_nonce , exp , min_bits , value , message , m_len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( p_len < = secp256k1_rangeproof_max_size ( ctx , value , min_bits ) ) ;
CHECK ( p_len = = sizeof ( proof ) ) ;
/* Uncomment the next line to print the test vector */
/* print_vector(0, proof, p_len, &pc); */
CHECK ( p_len = = sizeof ( vector_0 ) ) ;
CHECK ( secp256k1_memcmp_var ( proof , vector_0 , p_len ) = = 0 ) ;
2022-01-12 12:23:41 +00:00
test_rangeproof_fixed_vectors_reproducible_helper ( vector_0 , sizeof ( vector_0 ) , commit_0 , & value_r , & min_value_r , & max_value_r , message_r , & m_len_r ) ;
CHECK ( value_r = = value ) ;
CHECK ( m_len_r = = m_len ) ;
CHECK ( secp256k1_memcmp_var ( message_r , message , m_len_r ) = = 0 ) ;
CHECK ( min_value_r = = min_value ) ;
CHECK ( max_value_r = = UINT64_MAX ) ;
memset ( message_r , 0 , sizeof ( message_r ) ) ;
}
/* Test min_bits = 3 */
{
uint64_t value = 13 ;
size_t m_len = 128 ; /* maximum message length with min_bits = 3 */
2022-08-20 16:06:46 +00:00
uint64_t min_value = 1 ;
int min_bits = 3 ;
int exp = 1 ;
unsigned char proof [ 267 ] ;
size_t p_len = sizeof ( proof ) ;
secp256k1_pedersen_commitment pc ;
2022-01-12 12:23:41 +00:00
unsigned char vector_1 [ ] = {
0x61 , 0x02 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x00 , 0x03 , 0x01 , 0xcb , 0xdc , 0xbe , 0x42 , 0xe6 ,
0x44 , 0x1e , 0xc4 , 0x63 , 0x9d , 0xb1 , 0x93 , 0x7b , 0x49 , 0xdc , 0xd5 , 0x6e , 0x55 , 0xdd , 0x3b , 0x1e ,
0x41 , 0x1c , 0x0e , 0xd7 , 0x47 , 0xd7 , 0xf0 , 0x26 , 0xf7 , 0xe4 , 0x36 , 0xbd , 0x51 , 0xb9 , 0x77 , 0x90 ,
0x33 , 0xdd , 0x64 , 0xe7 , 0x47 , 0x38 , 0x49 , 0x29 , 0x12 , 0xa8 , 0x12 , 0x79 , 0xbc , 0x62 , 0xea , 0xf9 ,
0xb5 , 0x51 , 0x8f , 0x51 , 0xea , 0x28 , 0x5d , 0x30 , 0x9f , 0x30 , 0xd5 , 0x93 , 0x31 , 0x56 , 0x61 , 0x01 ,
0xd7 , 0x7f , 0xa4 , 0xec , 0xfc , 0xe5 , 0x83 , 0x52 , 0x5a , 0xe0 , 0x80 , 0x76 , 0x40 , 0xb8 , 0x8d , 0x67 ,
0x23 , 0x46 , 0x8c , 0xb8 , 0x74 , 0x2a , 0x20 , 0x12 , 0x86 , 0x4d , 0xd8 , 0x8c , 0x23 , 0x73 , 0x2f , 0xbe ,
0x99 , 0xa5 , 0xd5 , 0x8c , 0x11 , 0xc7 , 0xb2 , 0xf9 , 0xd3 , 0x7c , 0x88 , 0x16 , 0x4d , 0x21 , 0x80 , 0x10 ,
0x70 , 0xfc , 0x1f , 0x9b , 0x0b , 0x5e , 0xbe , 0xe3 , 0x65 , 0xe2 , 0x4f , 0xbd , 0x1d , 0xb0 , 0x64 , 0x0a ,
0xc5 , 0xe0 , 0x94 , 0x8b , 0x49 , 0xf7 , 0xc4 , 0x88 , 0x5e , 0xc0 , 0x2d , 0xbb , 0x98 , 0x60 , 0x5f , 0xd2 ,
0x7a , 0x9a , 0xff , 0x9e , 0x1c , 0x1f , 0x45 , 0x34 , 0x08 , 0x96 , 0xa9 , 0xd3 , 0xa5 , 0x4d , 0x95 , 0x9c ,
0x1f , 0xe6 , 0xe5 , 0xdc , 0x32 , 0xbb , 0x18 , 0x4a , 0x76 , 0x22 , 0xe9 , 0x75 , 0x1f , 0x45 , 0x6b , 0x81 ,
0x70 , 0x4a , 0xc8 , 0x00 , 0x72 , 0x7a , 0xc8 , 0xee , 0xed , 0xc5 , 0x19 , 0x8f , 0xec , 0x7b , 0x4b , 0xfd ,
0x7f , 0xc8 , 0x51 , 0xda , 0x28 , 0x0e , 0x95 , 0xd3 , 0xc6 , 0xc1 , 0x29 , 0x28 , 0x3f , 0xd8 , 0x3d , 0x41 ,
0xde , 0xdf , 0xfc , 0x2b , 0x71 , 0x3a , 0xdb , 0x78 , 0xa4 , 0x0e , 0x50 , 0xb8 , 0xf9 , 0xae , 0xdb , 0x7b ,
0xb1 , 0x31 , 0x81 , 0xc2 , 0xf2 , 0xb5 , 0x01 , 0x64 , 0x8e , 0x86 , 0xe2 , 0x8b , 0x67 , 0x13 , 0xec , 0x7e ,
0xf5 , 0xad , 0x9d , 0x57 , 0x2b , 0x5d , 0x0c , 0x94 , 0xa9 , 0x89 , 0x92 ,
} ;
unsigned char commit_1 [ ] = {
0x09 , 0xe5 , 0xb3 , 0x27 , 0x82 , 0x88 , 0xeb , 0x21 , 0xcd , 0xb2 , 0x56 , 0x37 , 0x61 , 0x84 , 0xce , 0xc1 ,
0x66 , 0x16 , 0x2e , 0x44 , 0xc8 , 0x65 , 0x8e , 0xe6 , 0x3a , 0x1a , 0x57 , 0x2c , 0xb9 , 0x6c , 0x07 , 0x85 ,
0xf0 ,
} ;
2022-08-20 16:06:46 +00:00
CHECK ( secp256k1_pedersen_commit ( ctx , & pc , vector_blind , value , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & p_len , min_value , & pc , vector_blind , vector_nonce , exp , min_bits , value , message , m_len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( p_len < = secp256k1_rangeproof_max_size ( ctx , value , min_bits ) ) ;
CHECK ( p_len = = sizeof ( proof ) ) ;
/* Uncomment the next line to print the test vector */
/* print_vector(1, proof, p_len, &pc); */
CHECK ( p_len = = sizeof ( vector_1 ) ) ;
CHECK ( secp256k1_memcmp_var ( proof , vector_1 , p_len ) = = 0 ) ;
2022-01-12 12:23:41 +00:00
test_rangeproof_fixed_vectors_reproducible_helper ( vector_1 , sizeof ( vector_1 ) , commit_1 , & value_r , & min_value_r , & max_value_r , message_r , & m_len_r ) ;
CHECK ( value_r = = value ) ;
CHECK ( m_len_r = = m_len ) ;
CHECK ( secp256k1_memcmp_var ( message_r , message , m_len_r ) = = 0 ) ;
CHECK ( min_value_r = = 3 ) ;
CHECK ( max_value_r = = 73 ) ;
memset ( message_r , 0 , sizeof ( message_r ) ) ;
}
/* Test large min_value */
{
uint64_t value = INT64_MAX ;
size_t m_len = 0 ; /* maximum message length with min_bits = 3 */
/* Uncomment this to recreate test vector */
2022-08-20 16:06:46 +00:00
uint64_t min_value = INT64_MAX - 1 ;
int min_bits = 1 ;
int exp = 0 ;
unsigned char proof [ 106 ] ;
size_t p_len = sizeof ( proof ) ;
secp256k1_pedersen_commitment pc ;
2022-01-12 12:23:41 +00:00
unsigned char vector_2 [ ] = {
0x60 , 0x00 , 0x7f , 0xff , 0xff , 0xff , 0xff , 0xff , 0xff , 0xfe , 0x81 , 0xd8 , 0x21 , 0x12 , 0x4d , 0xa4 ,
0x84 , 0xdd , 0x2c , 0xd1 , 0x04 , 0xe7 , 0x08 , 0x9a , 0xd3 , 0x6f , 0xa5 , 0xd8 , 0xfc , 0x52 , 0x4c , 0xba ,
0xf0 , 0x83 , 0xeb , 0x76 , 0x9f , 0x1c , 0x03 , 0xe3 , 0xcf , 0x23 , 0x1e , 0x40 , 0x18 , 0xc6 , 0x6d , 0xf9 ,
0x25 , 0x56 , 0x80 , 0x3c , 0x83 , 0xdd , 0x58 , 0x36 , 0x43 , 0xe3 , 0x56 , 0xa0 , 0xb7 , 0xf0 , 0x0e , 0xf9 ,
0xe2 , 0x8b , 0x82 , 0x5a , 0x77 , 0xa7 , 0xbe , 0x36 , 0x98 , 0x10 , 0x99 , 0x2e , 0xaa , 0x21 , 0x24 , 0xe6 ,
0x78 , 0xa8 , 0xcc , 0xc7 , 0x06 , 0x1c , 0x06 , 0xb0 , 0x03 , 0x87 , 0x86 , 0x89 , 0xce , 0x85 , 0x88 , 0xea ,
0xa1 , 0x9d , 0x4d , 0xfd , 0x8d , 0x65 , 0xbd , 0xa9 , 0xd0 , 0x0f ,
} ;
unsigned char commit_2 [ ] = {
0x09 , 0x2a , 0x74 , 0xa1 , 0x9c , 0xee , 0xcb , 0x6a , 0xd1 , 0xa7 , 0x97 , 0xbe , 0x97 , 0xe7 , 0xb6 , 0x37 ,
0x90 , 0x96 , 0xc2 , 0x5a , 0xe5 , 0xfc , 0xed , 0x91 , 0xff , 0x4c , 0x67 , 0x07 , 0x96 , 0x1d , 0x2a , 0xb3 ,
0x70 ,
} ;
2022-08-20 16:06:46 +00:00
CHECK ( secp256k1_pedersen_commit ( ctx , & pc , vector_blind , value , secp256k1_generator_h ) ) ;
CHECK ( secp256k1_rangeproof_sign ( ctx , proof , & p_len , min_value , & pc , vector_blind , vector_nonce , exp , min_bits , value , message , m_len , NULL , 0 , secp256k1_generator_h ) ) ;
CHECK ( p_len < = secp256k1_rangeproof_max_size ( ctx , value , min_bits ) ) ;
CHECK ( p_len = = sizeof ( proof ) ) ;
/* Uncomment the next line to print the test vector */
/* print_vector(2, proof, p_len, &pc); */
CHECK ( p_len = = sizeof ( vector_2 ) ) ;
CHECK ( secp256k1_memcmp_var ( proof , vector_2 , p_len ) = = 0 ) ;
2022-01-12 12:23:41 +00:00
test_rangeproof_fixed_vectors_reproducible_helper ( vector_2 , sizeof ( vector_2 ) , commit_2 , & value_r , & min_value_r , & max_value_r , message_r , & m_len_r ) ;
CHECK ( value_r = = value ) ;
CHECK ( m_len_r = = m_len ) ;
CHECK ( secp256k1_memcmp_var ( message_r , message , m_len_r ) = = 0 ) ;
CHECK ( min_value_r = = INT64_MAX - 1 ) ;
CHECK ( max_value_r = = INT64_MAX ) ;
memset ( message_r , 0 , sizeof ( message_r ) ) ;
}
}
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
void run_rangeproof_tests ( void ) {
int i ;
2017-05-03 18:08:31 +00:00
test_api ( ) ;
2021-10-17 00:16:57 +00:00
test_single_value_proof ( 0 ) ;
test_single_value_proof ( 12345678 ) ;
test_single_value_proof ( UINT64_MAX ) ;
2018-10-02 17:58:39 +00:00
test_rangeproof_fixed_vectors ( ) ;
2022-01-12 12:23:41 +00:00
test_rangeproof_fixed_vectors_reproducible ( ) ;
2020-11-16 16:05:24 +00:00
for ( i = 0 ; i < count / 2 + 1 ; i + + ) {
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
test_borromean ( ) ;
}
test_rangeproof ( ) ;
2022-08-05 21:05:09 +00:00
test_rangeproof_null_blinder ( ) ;
2016-07-06 15:44:09 +00:00
test_multiple_generators ( ) ;
Pedersen commitments, borromean ring signatures, and ZK range proofs.
This commit adds three new cryptosystems to libsecp256k1:
Pedersen commitments are a system for making blinded commitments
to a value. Functionally they work like:
commit_b,v = H(blind_b || value_v),
except they are additively homorphic, e.g.
C(b1, v1) - C(b2, v2) = C(b1 - b2, v1 - v2) and
C(b1, v1) - C(b1, v1) = 0, etc.
The commitments themselves are EC points, serialized as 33 bytes.
In addition to the commit function this implementation includes
utility functions for verifying that a set of commitments sums
to zero, and for picking blinding factors that sum to zero.
If the blinding factors are uniformly random, pedersen commitments
have information theoretic privacy.
Borromean ring signatures are a novel efficient ring signature
construction for AND/OR admissions policies (the code here implements
an AND of ORs, each of any size). This construction requires
32 bytes of signature per pubkey used plus 32 bytes of constant
overhead. With these you can construct signatures like "Given pubkeys
A B C D E F G, the signer knows the discrete logs
satisifying (A || B) & (C || D || E) & (F || G)".
ZK range proofs allow someone to prove a pedersen commitment is in
a particular range (e.g. [0..2^64)) without revealing the specific
value. The construction here is based on the above borromean
ring signature and uses a radix-4 encoding and other optimizations
to maximize efficiency. It also supports encoding proofs with a
non-private base-10 exponent and minimum-value to allow trading
off secrecy for size and speed (or just avoiding wasting space
keeping data private that was already public due to external
constraints).
A proof for a 32-bit mantissa takes 2564 bytes, but 2048 bytes of
this can be used to communicate a private message to a receiver
who shares a secret random seed with the prover.
Also: get rid of precomputed H tables (Pieter Wuille)
2015-08-05 19:04:14 +02:00
}
# endif
