* Initial stab at Bulletproofs+
Does move around the existing Bulletproofs code, does still work as
expected.
* Make the Clsag RCTPrunable type work with BP and BP+
* Initial set of BP+ bug fixes
* Further bug fixes
* Remove RING_LEN as a constant
* Monero v16 TX support
Doesn't implement view tags, nor going back to v14, nor the updated BP
clawback logic.
* Support v14 and v16 at the same time
Updates how change outputs are handled, with a far more logical
construction offering greater flexibility.
prepare_outputs can not longer error. SignaableTransaction::new will.
While it was fine as-is, as it only had one variable length property,
this is a bit more robust. Also binds the Curve ID, which should declare
differently even for just different basepoints, and therefore adds two
variable length properties (justifying the transcript).
Saves roughly 0.8s when running the tests, which took 16.6s and now take
15.8 (5%).
Removes the larger sample size, which replaced the closest selected
decoy with the real spend, per advice of Rucknium.
Saves ~8% during FROST key gen, even with dropping a vartime for a
constant time (as needed to be secure), as the new batch verifier is
used where batch verification previously wasn't. The new multiexp API
itself also offered a very slight performance boost, which may solely be
a measurement error.
Handles most of https://github.com/serai-dex/serai/issues/10. The blame
function isn't binary searched nor randomly sorted yet.
Honestly, the borrowed keys are frustrating, and this probably reduces
performance while no longer offering an order when iterating. That said,
they enable full u16 indexing and should mildly improve the API.
Cleans the Proof of Knowledge handling present in key gen.
Currently solely used for single signer change outputs, intended to be
used for funds into Serai and multisig change outputs (dependent on #2).
Also cleans the file layout, makes scanning a bit more robust, doesn't
return outputs of amount 0, and shuffles outputs.
Remove's CLSAG's msg Rc for the msg available through AlgorithmMachine.
Potentially slightly more inefficient, as it needs to be converted from
a slice to a [u8; 32], yet removes a re-impl.
Also removes a match for an if.
Updates decoy selection with an explicit panic, the removal of a divide
by 0 (causing tests to fail on new chains), and a minor optimization
when dealing with a large quantity of locked outputs.
Also increases documentation, acknowledging infinite loops and breakage
from Monero more.
Updates CLSAG signing as needed. Moves around Error types.
CLSAG multisig and the multisig feature is currently completely borked
because of this. The created TXs are accepted by Monero nodes.
