BP Verification (#75)

* Use a struct in an enum for Bulletproofs

* verification bp working for just one proof

* add some more assert tests

* Clean BP verification

* Implement batch verification

* Add a debug assertion w_cache isn't 0

It's initially set to 0 and if not updated, this would be broken.

* Correct Monero workflow yaml

* Again try to corrent Monero workflow yaml

* Again

* Finally

* Re-apply weights as required by Bulletproofs

Removing these was insecure and my fault.

Co-authored-by: DangerousFreedom <dangfreed@tutanota.com>

.github/workflows/monero-tests.yaml

@@ -51,7 +51,7 @@ jobs:
 
       - name: Run Integration Tests
         # Don't run if the the tests workflow also will
-        if: ${{ matrix.version != "v0.18.0.0" }}
+        if: ${{ matrix.version != 'v0.18.0.0' }}
         run: |
           cargo test --package monero-serai --all-features --test '*'
           cargo test --package serai-processor monero

coins/monero/Cargo.toml

@@ -25,7 +25,7 @@ curve25519-dalek = { version = "3", features = ["std"] }
 
 group = { version = "0.12" }
 dalek-ff-group = { path = "../../crypto/dalek-ff-group" }
-multiexp = { path = "../../crypto/multiexp" }
+multiexp = { path = "../../crypto/multiexp", features = ["batch"] }
 
 transcript = { package = "flexible-transcript", path = "../../crypto/transcript", features = ["recommended"], optional = true }
 frost = { package = "modular-frost", path = "../../crypto/frost", features = ["ed25519"], optional = true }

coins/monero/src/ringct/bulletproofs/core.rs

@@ -7,12 +7,12 @@ use rand_core::{RngCore, CryptoRng};
 use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint};
 
 use group::{ff::Field, Group};
-use dalek_ff_group::{ED25519_BASEPOINT_POINT, Scalar, EdwardsPoint};
+use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint};
 
-use multiexp::multiexp as const_multiexp;
+use multiexp::{BatchVerifier, multiexp as multiexp_const};
 
 fn prove_multiexp(pairs: &[(Scalar, EdwardsPoint)]) -> EdwardsPoint {
-  const_multiexp(pairs) * *INV_EIGHT
+  multiexp_const(pairs) * *INV_EIGHT
 }
 
 use crate::{
@@ -108,9 +108,11 @@ fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) {
   (aL, aR)
 }
 
-fn hash_commitments(commitments: &[Commitment]) -> Scalar {
-  let V = commitments.iter().map(|c| EdwardsPoint(c.calculate()) * *INV_EIGHT).collect::<Vec<_>>();
-  hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>())
+fn hash_commitments<C: IntoIterator<Item = DalekPoint>>(
+  commitments: C,
+) -> (Scalar, Vec<EdwardsPoint>) {
+  let V = commitments.into_iter().map(|c| EdwardsPoint(c) * *INV_EIGHT).collect::<Vec<_>>();
+  (hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>()), V)
 }
 
 fn alpha_rho<R: RngCore + CryptoRng>(
@@ -161,41 +163,198 @@ lazy_static! {
 }
 
 // TRANSCRIPT_PLUS isn't a Scalar, so we need this alternative for the first hash
-fn hash_plus(mash: &[[u8; 32]]) -> Scalar {
-  let slice =
-    &[&*TRANSCRIPT_PLUS as &[u8], mash.iter().cloned().flatten().collect::<Vec<_>>().as_ref()]
-      .concat();
-  hash_to_scalar(slice)
+fn hash_plus(mash: &[u8]) -> Scalar {
+  hash_to_scalar(&[&*TRANSCRIPT_PLUS as &[u8], mash].concat())
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct OriginalStruct {
+  pub(crate) A: DalekPoint,
+  pub(crate) S: DalekPoint,
+  pub(crate) T1: DalekPoint,
+  pub(crate) T2: DalekPoint,
+  pub(crate) taux: DalekScalar,
+  pub(crate) mu: DalekScalar,
+  pub(crate) L: Vec<DalekPoint>,
+  pub(crate) R: Vec<DalekPoint>,
+  pub(crate) a: DalekScalar,
+  pub(crate) b: DalekScalar,
+  pub(crate) t: DalekScalar,
+}
+
+impl OriginalStruct {
+  #[must_use]
+  fn verify_core<ID: Copy, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, EdwardsPoint>,
+    id: ID,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    // Verify commitments are valid
+    if commitments.is_empty() || (commitments.len() > MAX_M) {
+      return false;
+    }
+
+    // Verify L and R are properly sized
+    if self.L.len() != self.R.len() {
+      return false;
+    }
+
+    let (logMN, M, MN) = MN(commitments.len());
+    if self.L.len() != logMN {
+      return false;
+    }
+
+    // Rebuild all challenges
+    let (mut cache, commitments) = hash_commitments(commitments.iter().cloned());
+    let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]);
+
+    let z = hash_to_scalar(&y.to_bytes());
+    cache = z;
+
+    let x = hash_cache(
+      &mut cache,
+      &[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()],
+    );
+
+    let x_ip = hash_cache(
+      &mut cache,
+      &[x.to_bytes(), self.taux.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()],
+    );
+
+    let mut w = Vec::with_capacity(logMN);
+    let mut winv = Vec::with_capacity(logMN);
+    for (L, R) in self.L.iter().zip(&self.R) {
+      w.push(hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()]));
+      winv.push(cache.invert().unwrap());
+    }
+
+    // Convert the proof from * INV_EIGHT to its actual form
+    let normalize = |point: &DalekPoint| EdwardsPoint(point.mul_by_cofactor());
+
+    let L = self.L.iter().map(normalize).collect::<Vec<_>>();
+    let R = self.R.iter().map(normalize).collect::<Vec<_>>();
+    let T1 = normalize(&self.T1);
+    let T2 = normalize(&self.T2);
+    let A = normalize(&self.A);
+    let S = normalize(&self.S);
+
+    let commitments = commitments.iter().map(|c| c.mul_by_cofactor()).collect::<Vec<_>>();
+
+    // Verify it
+    let mut proof = Vec::with_capacity(4 + commitments.len());
+
+    let zpow = ScalarVector::powers(z, M + 3);
+    let ip1y = ScalarVector::powers(y, M * N).sum();
+    let mut k = -(zpow[2] * ip1y);
+    for j in 1 ..= M {
+      k -= zpow[j + 2] * *IP12;
+    }
+    let y1 = Scalar(self.t) - ((z * ip1y) + k);
+    proof.push((-y1, *H));
+
+    proof.push((-Scalar(self.taux), G));
+
+    for (j, commitment) in commitments.iter().enumerate() {
+      proof.push((zpow[j + 2], *commitment));
+    }
+
+    proof.push((x, T1));
+    proof.push((x * x, T2));
+    verifier.queue(&mut *rng, id, proof);
+
+    proof = Vec::with_capacity(4 + (2 * (MN + logMN)));
+    let z3 = (Scalar(self.t) - (Scalar(self.a) * Scalar(self.b))) * x_ip;
+    proof.push((z3, *H));
+    proof.push((-Scalar(self.mu), G));
+
+    proof.push((Scalar::one(), A));
+    proof.push((x, S));
+
+    {
+      let ypow = ScalarVector::powers(y, MN);
+      let yinv = y.invert().unwrap();
+      let yinvpow = ScalarVector::powers(yinv, MN);
+
+      let mut w_cache = vec![Scalar::zero(); MN];
+      w_cache[0] = winv[0];
+      w_cache[1] = w[0];
+      for j in 1 .. logMN {
+        let mut slots = (1 << (j + 1)) - 1;
+        while slots > 0 {
+          w_cache[slots] = w_cache[slots / 2] * w[j];
+          w_cache[slots - 1] = w_cache[slots / 2] * winv[j];
+          slots = slots.saturating_sub(2);
+        }
+      }
+
+      for w in &w_cache {
+        debug_assert!(!bool::from(w.is_zero()));
+      }
+
+      for i in 0 .. MN {
+        let g = (Scalar(self.a) * w_cache[i]) + z;
+        proof.push((-g, GENERATORS.G[i]));
+
+        let mut h = Scalar(self.b) * yinvpow[i] * w_cache[(!i) & (MN - 1)];
+        h -= ((zpow[(i / N) + 2] * TWO_N[i % N]) + (z * ypow[i])) * yinvpow[i];
+        proof.push((-h, GENERATORS.H[i]));
+      }
+    }
+
+    for i in 0 .. logMN {
+      proof.push((w[i] * w[i], L[i]));
+      proof.push((winv[i] * winv[i], R[i]));
+    }
+    verifier.queue(rng, id, proof);
+
+    true
+  }
+
+  #[must_use]
+  pub(crate) fn verify<R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    let mut verifier = BatchVerifier::new(4 + commitments.len() + 4 + (2 * (MAX_MN + 10)));
+    if self.verify_core(rng, &mut verifier, (), commitments) {
+      verifier.verify_vartime()
+    } else {
+      false
+    }
+  }
+
+  #[must_use]
+  pub(crate) fn batch_verify<ID: Copy, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, EdwardsPoint>,
+    id: ID,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    self.verify_core(rng, verifier, id, commitments)
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct PlusStruct {
+  pub(crate) A: DalekPoint,
+  pub(crate) A1: DalekPoint,
+  pub(crate) B: DalekPoint,
+  pub(crate) r1: DalekScalar,
+  pub(crate) s1: DalekScalar,
+  pub(crate) d1: DalekScalar,
+  pub(crate) L: Vec<DalekPoint>,
+  pub(crate) R: Vec<DalekPoint>,
 }
 
-// Types for all Bulletproofs
 #[allow(clippy::large_enum_variant)]
 #[derive(Clone, PartialEq, Eq, Debug)]
 pub enum Bulletproofs {
-  Original {
-    A: DalekPoint,
-    S: DalekPoint,
-    T1: DalekPoint,
-    T2: DalekPoint,
-    taux: DalekScalar,
-    mu: DalekScalar,
-    L: Vec<DalekPoint>,
-    R: Vec<DalekPoint>,
-    a: DalekScalar,
-    b: DalekScalar,
-    t: DalekScalar,
-  },
-
-  Plus {
-    A: DalekPoint,
-    A1: DalekPoint,
-    B: DalekPoint,
-    r1: DalekScalar,
-    s1: DalekScalar,
-    d1: DalekScalar,
-    L: Vec<DalekPoint>,
-    R: Vec<DalekPoint>,
-  },
+  Original(OriginalStruct),
+  Plus(PlusStruct),
 }
 
 pub(crate) fn prove<R: RngCore + CryptoRng>(
@@ -205,7 +364,7 @@ pub(crate) fn prove<R: RngCore + CryptoRng>(
   let (logMN, M, MN) = MN(commitments.len());
 
   let (aL, aR) = bit_decompose(commitments);
-  let mut cache = hash_commitments(commitments);
+  let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate));
   let (alpha, A) = alpha_rho(&mut *rng, &GENERATORS, &aL, &aR);
 
   let (sL, sR) =
@@ -297,7 +456,7 @@ pub(crate) fn prove<R: RngCore + CryptoRng>(
     }
   }
 
-  Bulletproofs::Original {
+  Bulletproofs::Original(OriginalStruct {
     A: *A,
     S: *S,
     T1: *T1,
@@ -309,7 +468,7 @@ pub(crate) fn prove<R: RngCore + CryptoRng>(
     a: *a[0],
     b: *b[0],
     t: *t,
-  }
+  })
 }
 
 pub(crate) fn prove_plus<R: RngCore + CryptoRng>(
@@ -319,7 +478,8 @@ pub(crate) fn prove_plus<R: RngCore + CryptoRng>(
   let (logMN, M, MN) = MN(commitments.len());
 
   let (aL, aR) = bit_decompose(commitments);
-  let mut cache = hash_plus(&[hash_commitments(commitments).to_bytes()]);
+  let (mut cache, _) = hash_commitments(commitments.iter().map(Commitment::calculate));
+  cache = hash_plus(&cache.to_bytes());
   let (mut alpha1, A) = alpha_rho(&mut *rng, &GENERATORS_PLUS, &aL, &aR);
 
   let y = hash_cache(&mut cache, &[A.compress().to_bytes()]);
@@ -371,12 +531,12 @@ pub(crate) fn prove_plus<R: RngCore + CryptoRng>(
     let (H_L, H_R) = H_proof.split_at(aL.len());
 
     let mut L_i = LR_statements(&(&aL * yinvpow[aL.len()]), G_R, &bR, H_L, cL, *H);
-    L_i.push((dL, ED25519_BASEPOINT_POINT));
+    L_i.push((dL, G));
     let L_i = prove_multiexp(&L_i);
     L.push(L_i);
 
     let mut R_i = LR_statements(&(&aR * ypow[aR.len()]), G_L, &bL, H_R, cR, *H);
-    R_i.push((dR, ED25519_BASEPOINT_POINT));
+    R_i.push((dR, G));
     let R_i = prove_multiexp(&R_i);
     R.push(R_i);
 
@@ -400,17 +560,17 @@ pub(crate) fn prove_plus<R: RngCore + CryptoRng>(
   let A1 = prove_multiexp(&[
     (r, G_proof[0]),
     (s, H_proof[0]),
-    (d, ED25519_BASEPOINT_POINT),
+    (d, G),
     ((r * y * b[0]) + (s * y * a[0]), *H),
   ]);
-  let B = prove_multiexp(&[(r * y * s, *H), (eta, ED25519_BASEPOINT_POINT)]);
+  let B = prove_multiexp(&[(r * y * s, *H), (eta, G)]);
   let e = hash_cache(&mut cache, &[A1.compress().to_bytes(), B.compress().to_bytes()]);
 
   let r1 = (a[0] * e) + r;
   let s1 = (b[0] * e) + s;
   let d1 = ((d * e) + eta) + (alpha1 * (e * e));
 
-  Bulletproofs::Plus {
+  Bulletproofs::Plus(PlusStruct {
     A: *A,
     A1: *A1,
     B: *B,
@@ -419,5 +579,5 @@ pub(crate) fn prove_plus<R: RngCore + CryptoRng>(
     d1: *d1,
     L: L.drain(..).map(|L| *L).collect(),
     R: R.drain(..).map(|R| *R).collect(),
-  }
+  })
 }

coins/monero/src/ringct/bulletproofs/mod.rs

@@ -3,14 +3,15 @@
 use rand_core::{RngCore, CryptoRng};
 
 use curve25519_dalek::edwards::EdwardsPoint;
+use multiexp::BatchVerifier;
 
 use crate::{Commitment, wallet::TransactionError, serialize::*};
 
 pub(crate) mod scalar_vector;
 
-mod core;
+pub mod core;
 pub(crate) use self::core::Bulletproofs;
-use self::core::{MAX_M, prove, prove_plus};
+use self::core::{MAX_M, OriginalStruct, PlusStruct, prove, prove_plus};
 
 pub(crate) const MAX_OUTPUTS: usize = MAX_M;
 
@@ -41,35 +42,57 @@ impl Bulletproofs {
     Ok(if !plus { prove(rng, outputs) } else { prove_plus(rng, outputs) })
   }
 
+  #[must_use]
+  pub fn verify<R: RngCore + CryptoRng>(&self, rng: &mut R, commitments: &[EdwardsPoint]) -> bool {
+    match self {
+      Bulletproofs::Original(bp) => bp.verify(rng, commitments),
+      Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"),
+    }
+  }
+
+  #[must_use]
+  pub fn batch_verify<ID: Copy, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, dalek_ff_group::EdwardsPoint>,
+    id: ID,
+    commitments: &[EdwardsPoint],
+  ) -> bool {
+    match self {
+      Bulletproofs::Original(bp) => bp.batch_verify(rng, verifier, id, commitments),
+      Bulletproofs::Plus(_) => unimplemented!("Bulletproofs+ verification isn't implemented"),
+    }
+  }
+
   fn serialize_core<W: std::io::Write, F: Fn(&[EdwardsPoint], &mut W) -> std::io::Result<()>>(
     &self,
     w: &mut W,
     specific_write_vec: F,
   ) -> std::io::Result<()> {
     match self {
-      Bulletproofs::Original { A, S, T1, T2, taux, mu, L, R, a, b, t } => {
-        write_point(A, w)?;
-        write_point(S, w)?;
-        write_point(T1, w)?;
-        write_point(T2, w)?;
-        write_scalar(taux, w)?;
-        write_scalar(mu, w)?;
-        specific_write_vec(L, w)?;
-        specific_write_vec(R, w)?;
-        write_scalar(a, w)?;
-        write_scalar(b, w)?;
-        write_scalar(t, w)
+      Bulletproofs::Original(bp) => {
+        write_point(&bp.A, w)?;
+        write_point(&bp.S, w)?;
+        write_point(&bp.T1, w)?;
+        write_point(&bp.T2, w)?;
+        write_scalar(&bp.taux, w)?;
+        write_scalar(&bp.mu, w)?;
+        specific_write_vec(&bp.L, w)?;
+        specific_write_vec(&bp.R, w)?;
+        write_scalar(&bp.a, w)?;
+        write_scalar(&bp.b, w)?;
+        write_scalar(&bp.t, w)
       }
 
-      Bulletproofs::Plus { A, A1, B, r1, s1, d1, L, R } => {
-        write_point(A, w)?;
-        write_point(A1, w)?;
-        write_point(B, w)?;
-        write_scalar(r1, w)?;
-        write_scalar(s1, w)?;
-        write_scalar(d1, w)?;
-        specific_write_vec(L, w)?;
-        specific_write_vec(R, w)
+      Bulletproofs::Plus(bp) => {
+        write_point(&bp.A, w)?;
+        write_point(&bp.A1, w)?;
+        write_point(&bp.B, w)?;
+        write_scalar(&bp.r1, w)?;
+        write_scalar(&bp.s1, w)?;
+        write_scalar(&bp.d1, w)?;
+        specific_write_vec(&bp.L, w)?;
+        specific_write_vec(&bp.R, w)
       }
     }
   }
@@ -83,7 +106,7 @@ impl Bulletproofs {
   }
 
   pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Bulletproofs> {
-    Ok(Bulletproofs::Original {
+    Ok(Bulletproofs::Original(OriginalStruct {
       A: read_point(r)?,
       S: read_point(r)?,
       T1: read_point(r)?,
@@ -95,11 +118,11 @@ impl Bulletproofs {
       a: read_scalar(r)?,
       b: read_scalar(r)?,
       t: read_scalar(r)?,
-    })
+    }))
   }
 
   pub fn deserialize_plus<R: std::io::Read>(r: &mut R) -> std::io::Result<Bulletproofs> {
-    Ok(Bulletproofs::Plus {
+    Ok(Bulletproofs::Plus(PlusStruct {
       A: read_point(r)?,
       A1: read_point(r)?,
       B: read_point(r)?,
@@ -108,6 +131,6 @@ impl Bulletproofs {
       d1: read_scalar(r)?,
       L: read_vec(read_point, r)?,
       R: read_vec(read_point, r)?,
-    })
+    }))
   }
 }

coins/monero/src/tests/bulletproofs.rs

@@ -0,0 +1,83 @@
+use hex_literal::hex;
+use rand::rngs::OsRng;
+
+use curve25519_dalek::{scalar::Scalar, edwards::CompressedEdwardsY};
+use multiexp::BatchVerifier;
+
+use crate::{
+  Commitment, random_scalar,
+  ringct::bulletproofs::{Bulletproofs, core::OriginalStruct},
+};
+
+#[test]
+fn bulletproofs_vector() {
+  let scalar = |scalar| Scalar::from_canonical_bytes(scalar).unwrap();
+  let point = |point| CompressedEdwardsY(point).decompress().unwrap();
+
+  // Generated from Monero
+  assert!(Bulletproofs::Original(OriginalStruct {
+    A: point(hex!("ef32c0b9551b804decdcb107eb22aa715b7ce259bf3c5cac20e24dfa6b28ac71")),
+    S: point(hex!("e1285960861783574ee2b689ae53622834eb0b035d6943103f960cd23e063fa0")),
+    T1: point(hex!("4ea07735f184ba159d0e0eb662bac8cde3eb7d39f31e567b0fbda3aa23fe5620")),
+    T2: point(hex!("b8390aa4b60b255630d40e592f55ec6b7ab5e3a96bfcdcd6f1cd1d2fc95f441e")),
+    taux: scalar(hex!("5957dba8ea9afb23d6e81cc048a92f2d502c10c749dc1b2bd148ae8d41ec7107")),
+    mu: scalar(hex!("923023b234c2e64774b820b4961f7181f6c1dc152c438643e5a25b0bf271bc02")),
+    L: vec![
+      point(hex!("c45f656316b9ebf9d357fb6a9f85b5f09e0b991dd50a6e0ae9b02de3946c9d99")),
+      point(hex!("9304d2bf0f27183a2acc58cc755a0348da11bd345485fda41b872fee89e72aac")),
+      point(hex!("1bb8b71925d155dd9569f64129ea049d6149fdc4e7a42a86d9478801d922129b")),
+      point(hex!("5756a7bf887aa72b9a952f92f47182122e7b19d89e5dd434c747492b00e1c6b7")),
+      point(hex!("6e497c910d102592830555356af5ff8340e8d141e3fb60ea24cfa587e964f07d")),
+      point(hex!("f4fa3898e7b08e039183d444f3d55040f3c790ed806cb314de49f3068bdbb218")),
+      point(hex!("0bbc37597c3ead517a3841e159c8b7b79a5ceaee24b2a9a20350127aab428713")),
+    ],
+    R: vec![
+      point(hex!("609420ba1702781692e84accfd225adb3d077aedc3cf8125563400466b52dbd9")),
+      point(hex!("fb4e1d079e7a2b0ec14f7e2a3943bf50b6d60bc346a54fcf562fb234b342abf8")),
+      point(hex!("6ae3ac97289c48ce95b9c557289e82a34932055f7f5e32720139824fe81b12e5")),
+      point(hex!("d071cc2ffbdab2d840326ad15f68c01da6482271cae3cf644670d1632f29a15c")),
+      point(hex!("e52a1754b95e1060589ba7ce0c43d0060820ebfc0d49dc52884bc3c65ad18af5")),
+      point(hex!("41573b06140108539957df71aceb4b1816d2409ce896659aa5c86f037ca5e851")),
+      point(hex!("a65970b2cc3c7b08b2b5b739dbc8e71e646783c41c625e2a5b1535e3d2e0f742")),
+    ],
+    a: scalar(hex!("0077c5383dea44d3cd1bc74849376bd60679612dc4b945255822457fa0c0a209")),
+    b: scalar(hex!("fe80cf5756473482581e1d38644007793ddc66fdeb9404ec1689a907e4863302")),
+    t: scalar(hex!("40dfb08e09249040df997851db311bd6827c26e87d6f0f332c55be8eef10e603"))
+  })
+  .verify(
+    &mut OsRng,
+    &[
+      // For some reason, these vectors are * INV_EIGHT
+      point(hex!("8e8f23f315edae4f6c2f948d9a861e0ae32d356b933cd11d2f0e031ac744c41f"))
+        .mul_by_cofactor(),
+      point(hex!("2829cbd025aa54cd6e1b59a032564f22f0b2e5627f7f2c4297f90da438b5510f"))
+        .mul_by_cofactor(),
+    ]
+  ));
+}
+
+#[test]
+fn bulletproofs() {
+  // Create Bulletproofs for all possible output quantities
+  let mut verifier = BatchVerifier::new(0);
+  for i in 1 .. 17 {
+    let commitments = (1 ..= i)
+      .map(|i| Commitment::new(random_scalar(&mut OsRng), u64::try_from(i).unwrap()))
+      .collect::<Vec<_>>();
+
+    let bp = Bulletproofs::prove(&mut OsRng, &commitments, false).unwrap();
+
+    let commitments = commitments.iter().map(Commitment::calculate).collect::<Vec<_>>();
+    assert!(bp.verify(&mut OsRng, &commitments));
+    assert!(bp.batch_verify(&mut OsRng, &mut verifier, i, &commitments));
+  }
+  assert!(verifier.verify_vartime());
+}
+
+#[test]
+fn bulletproofs_max() {
+  // Check Bulletproofs errors if we try to prove for too many outputs
+  assert!(
+    Bulletproofs::prove(&mut OsRng, &[Commitment::new(Scalar::zero(), 0); 17], false).is_err()
+  );
+}

coins/monero/src/tests/mod.rs

@@ -1,2 +1,3 @@
 mod clsag;
+mod bulletproofs;
 mod address;

crypto/dalek-ff-group/src/lib.rs

@@ -372,6 +372,12 @@ dalek_group!(
   ED25519_BASEPOINT_TABLE
 );
 
+impl EdwardsPoint {
+  pub fn mul_by_cofactor(&self) -> EdwardsPoint {
+    EdwardsPoint(self.0.mul_by_cofactor())
+  }
+}
+
 dalek_group!(
   RistrettoPoint,
   DRistrettoPoint,