BulletProof伪代码说明

以证明数字在[0, 2⁶⁴ − 1]范围为例，考虑支持多个数字proof合计的情况，主要有以下几方面内容：

1. public parameters 公共变量

• l: cardinality of the subgroup of the elliptic curve used (Ed25519)
• N: bitsize of the elements whose range one wants to prove (N = 64)
• M: number of proofs to aggregate (upper-bounded by maxM = BULLETPROOF_MAX_OUTPUTS = 16)
• G: the base point of the subgroup of the elliptic curve used
• H: another generator of the subgroup of the elliptic curve used whose discrete log wrt G is not known and hard to find
• Gi: a list of MN generators of the subgroup of the elliptic curve used whose discrete log wrt any other generator is not known and hard to find
• Hi: a list of MN generators of the subgroup of the elliptic curve used whose discrete log wrt any other generator is not known and hard to find

2. Values to commit to, hide, and prove:需要证明的数据。即私有变量

• v: a list of M integers such that for all j, 0 <= v[j] < 2^N 。v为需要被证明的数字。
• gamma: a list of M integers such that for all j, 0 <= gamma[j] < l。gamma为随机数，用于帮助隐藏数字v，gamma若泄露，v值存在被暴力破解的情况。(The hiding value ? is used in the Pedersen commitment of ?. Knowing ? would allow an attacker to retrieve the value of ? through brute force, compromising the confidentiality of the committed amount.)

3. A bulletproof is composed of: Bulletproof组成

• V: a vector of curve points, Pedersen commitments to v[i] with hiding values gamma[i]
• A: a curve point, vector commitment to aL and aR with hiding value alpha
• S: a curve point, vector commitment to sL and sR with hiding value rho
• T1: a curve point, Pedersen commitment to t1 with hiding value tau1
• T2: a curve point, Pedersen commitment to t2 with hiding value tau2
• taux: a scalar, hiding value related to T1, T2, V and t
• mu: a scalar, hiding value related to A and S
• L: a vector of curve points of size log2(MN) computed in the inner product protocol
• R: a vector of curve points of size log2(MN) computed in the inner product protocol
• a: a scalar computed in the inner product protocol
• b: a scalar computed in the inner product protocol
• t: a scalar, inner product value to be verified

参考资料：
[1] https://ostif.org/wp-content/uploads/2018/10/OSTIF-QuarksLab-Monero-Bulletproofs-Final2.pdf