(no commit message provided)

crypto/bulletproof/generators.go

@@ -0,0 +1,57 @@
+//
+// Copyright Coinbase, Inc. All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+package bulletproof
+
+import (
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/sha3"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// generators contains a list of points to be used as generators for bulletproofs.
+type generators []curves.Point
+
+// ippGenerators holds generators necessary for an Inner Product Proof
+// It includes a single u generator, and a list of generators divided in half to G and H
+// See lines 10 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
+type ippGenerators struct {
+	G generators
+	H generators
+}
+
+// getGeneratorPoints generates generators using HashToCurve with Shake256(domain) as input
+// lenVector is the length of the scalars used for the Inner Product Proof
+// getGeneratorPoints will return 2*lenVector + 1 total points, split between a single u generator
+// and G and H lists of vectors per the IPP specification
+// See lines 10 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
+func getGeneratorPoints(lenVector int, domain []byte, curve curves.Curve) (*ippGenerators, error) {
+	shake := sha3.NewShake256()
+	_, err := shake.Write(domain)
+	if err != nil {
+		return nil, errors.Wrap(err, "getGeneratorPoints shake.Write")
+	}
+	numPoints := lenVector * 2
+	points := make([]curves.Point, numPoints)
+	for i := 0; i < numPoints; i++ {
+		bytes := [64]byte{}
+		_, err := shake.Read(bytes[:])
+		if err != nil {
+			return nil, errors.Wrap(err, "getGeneratorPoints shake.Read")
+		}
+		nextPoint := curve.Point.Hash(bytes[:])
+		points[i] = nextPoint
+	}
+	// Get G and H by splitting points in half
+	G, H, err := splitPointVector(points)
+	if err != nil {
+		return nil, errors.Wrap(err, "getGeneratorPoints splitPointVector")
+	}
+	out := ippGenerators{G: G, H: H}
+
+	return &out, nil
+}

crypto/bulletproof/generators_test.go

@@ -0,0 +1,61 @@
+package bulletproof
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/sha3"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestGeneratorsHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	gs, err := getGeneratorPoints(10, []byte("test"), *curve)
+	gsConcatenated := concatIPPGenerators(*gs)
+	require.NoError(t, err)
+	require.Len(t, gs.G, 10)
+	require.Len(t, gs.H, 10)
+	require.True(t, noDuplicates(gsConcatenated))
+}
+
+func TestGeneratorsUniquePerDomain(t *testing.T) {
+	curve := curves.ED25519()
+	gs1, err := getGeneratorPoints(10, []byte("test"), *curve)
+	gs1Concatenated := concatIPPGenerators(*gs1)
+	require.NoError(t, err)
+	gs2, err := getGeneratorPoints(10, []byte("test2"), *curve)
+	gs2Concatenated := concatIPPGenerators(*gs2)
+	require.NoError(t, err)
+	require.True(t, areDisjoint(gs1Concatenated, gs2Concatenated))
+}
+
+func noDuplicates(gs generators) bool {
+	seen := map[[32]byte]bool{}
+	for _, G := range gs {
+		value := sha3.Sum256(G.ToAffineCompressed())
+		if seen[value] {
+			return false
+		}
+		seen[value] = true
+	}
+	return true
+}
+
+func areDisjoint(gs1, gs2 generators) bool {
+	for _, g1 := range gs1 {
+		for _, g2 := range gs2 {
+			if g1.Equal(g2) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func concatIPPGenerators(ippGens ippGenerators) generators {
+	var out generators
+	out = append(out, ippGens.G...)
+	out = append(out, ippGens.H...)
+	return out
+}

crypto/bulletproof/helpers.go

@@ -0,0 +1,181 @@
+//
+// Copyright Coinbase, Inc. All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+package bulletproof
+
+import (
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// innerProduct takes two lists of scalars (a, b) and performs the dot product returning a single scalar.
+func innerProduct(a, b []curves.Scalar) (curves.Scalar, error) {
+	if len(a) != len(b) {
+		return nil, errors.New("length of scalar vectors must be the same")
+	}
+	if len(a) < 1 {
+		return nil, errors.New("length of vectors must be at least one")
+	}
+	// Get a new scalar of value zero of the same curve as input arguments
+	innerProduct := a[0].Zero()
+	for i, aElem := range a {
+		bElem := b[i]
+		// innerProduct = aElem*bElem + innerProduct
+		innerProduct = aElem.MulAdd(bElem, innerProduct)
+	}
+
+	return innerProduct, nil
+}
+
+// splitPointVector takes a vector of points, splits it in half returning each half.
+func splitPointVector(points []curves.Point) ([]curves.Point, []curves.Point, error) {
+	if len(points) < 1 {
+		return nil, nil, errors.New("length of points must be at least one")
+	}
+	if len(points)&0x01 != 0 {
+		return nil, nil, errors.New("length of points must be even")
+	}
+	nPrime := len(points) >> 1
+	firstHalf := points[:nPrime]
+	secondHalf := points[nPrime:]
+	return firstHalf, secondHalf, nil
+}
+
+// splitScalarVector takes a vector of scalars, splits it in half returning each half.
+func splitScalarVector(scalars []curves.Scalar) ([]curves.Scalar, []curves.Scalar, error) {
+	if len(scalars) < 1 {
+		return nil, nil, errors.New("length of scalars must be at least one")
+	}
+	if len(scalars)&0x01 != 0 {
+		return nil, nil, errors.New("length of scalars must be even")
+	}
+	nPrime := len(scalars) >> 1
+	firstHalf := scalars[:nPrime]
+	secondHalf := scalars[nPrime:]
+	return firstHalf, secondHalf, nil
+}
+
+// multiplyScalarToPointVector takes a single scalar and a list of points, multiplies each point by scalar.
+func multiplyScalarToPointVector(x curves.Scalar, g []curves.Point) []curves.Point {
+	products := make([]curves.Point, len(g))
+	for i, gElem := range g {
+		product := gElem.Mul(x)
+		products[i] = product
+	}
+
+	return products
+}
+
+// multiplyScalarToScalarVector takes a single scalar (x) and a list of scalars (a), multiplies each scalar in the vector by the scalar.
+func multiplyScalarToScalarVector(x curves.Scalar, a []curves.Scalar) []curves.Scalar {
+	products := make([]curves.Scalar, len(a))
+	for i, aElem := range a {
+		product := aElem.Mul(x)
+		products[i] = product
+	}
+
+	return products
+}
+
+// multiplyPairwisePointVectors takes two lists of points (g, h) and performs a pairwise multiplication returning a list of points.
+func multiplyPairwisePointVectors(g, h []curves.Point) ([]curves.Point, error) {
+	if len(g) != len(h) {
+		return nil, errors.New("length of point vectors must be the same")
+	}
+	product := make([]curves.Point, len(g))
+	for i, gElem := range g {
+		product[i] = gElem.Add(h[i])
+	}
+
+	return product, nil
+}
+
+// multiplyPairwiseScalarVectors takes two lists of points (a, b) and performs a pairwise multiplication returning a list of scalars.
+func multiplyPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
+	if len(a) != len(b) {
+		return nil, errors.New("length of point vectors must be the same")
+	}
+	product := make([]curves.Scalar, len(a))
+	for i, aElem := range a {
+		product[i] = aElem.Mul(b[i])
+	}
+
+	return product, nil
+}
+
+// addPairwiseScalarVectors takes two lists of scalars (a, b) and performs a pairwise addition returning a list of scalars.
+func addPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
+	if len(a) != len(b) {
+		return nil, errors.New("length of scalar vectors must be the same")
+	}
+	sum := make([]curves.Scalar, len(a))
+	for i, aElem := range a {
+		sum[i] = aElem.Add(b[i])
+	}
+
+	return sum, nil
+}
+
+// subtractPairwiseScalarVectors takes two lists of scalars (a, b) and performs a pairwise subtraction returning a list of scalars.
+func subtractPairwiseScalarVectors(a, b []curves.Scalar) ([]curves.Scalar, error) {
+	if len(a) != len(b) {
+		return nil, errors.New("length of scalar vectors must be the same")
+	}
+	diff := make([]curves.Scalar, len(a))
+	for i, aElem := range a {
+		diff[i] = aElem.Sub(b[i])
+	}
+	return diff, nil
+}
+
+// invertScalars takes a list of scalars then returns a list with each element inverted.
+func invertScalars(xs []curves.Scalar) ([]curves.Scalar, error) {
+	xinvs := make([]curves.Scalar, len(xs))
+	for i, x := range xs {
+		xinv, err := x.Invert()
+		if err != nil {
+			return nil, errors.Wrap(err, "bulletproof helpers invertx")
+		}
+		xinvs[i] = xinv
+	}
+
+	return xinvs, nil
+}
+
+// isPowerOfTwo returns whether a number i is a power of two or not.
+func isPowerOfTwo(i int) bool {
+	return i&(i-1) == 0
+}
+
+// get2nVector returns a scalar vector 2^n such that [1, 2, 4, ... 2^(n-1)]
+// See k^n and 2^n definitions on pg 12 of https://eprint.iacr.org/2017/1066.pdf
+func get2nVector(length int, curve curves.Curve) []curves.Scalar {
+	vector2n := make([]curves.Scalar, length)
+	vector2n[0] = curve.Scalar.One()
+	for i := 1; i < length; i++ {
+		vector2n[i] = vector2n[i-1].Double()
+	}
+	return vector2n
+}
+
+func get1nVector(length int, curve curves.Curve) []curves.Scalar {
+	vector1n := make([]curves.Scalar, length)
+	for i := 0; i < length; i++ {
+		vector1n[i] = curve.Scalar.One()
+	}
+	return vector1n
+}
+
+func getknVector(k curves.Scalar, length int, curve curves.Curve) []curves.Scalar {
+	vectorkn := make([]curves.Scalar, length)
+	vectorkn[0] = curve.Scalar.One()
+	vectorkn[1] = k
+	for i := 2; i < length; i++ {
+		vectorkn[i] = vectorkn[i-1].Mul(k)
+	}
+	return vectorkn
+}

crypto/bulletproof/helpers_test.go

@@ -0,0 +1,85 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestInnerProductHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	a := randScalarVec(3, *curve)
+	b := randScalarVec(3, *curve)
+	_, err := innerProduct(a, b)
+	require.NoError(t, err)
+}
+
+func TestInnerProductMismatchedLengths(t *testing.T) {
+	curve := curves.ED25519()
+	a := randScalarVec(3, *curve)
+	b := randScalarVec(4, *curve)
+	_, err := innerProduct(a, b)
+	require.Error(t, err)
+}
+
+func TestInnerProductEmptyVector(t *testing.T) {
+	curve := curves.ED25519()
+	a := randScalarVec(0, *curve)
+	b := randScalarVec(0, *curve)
+	_, err := innerProduct(a, b)
+	require.Error(t, err)
+}
+
+func TestInnerProductOut(t *testing.T) {
+	curve := curves.ED25519()
+	a := randScalarVec(2, *curve)
+	b := randScalarVec(2, *curve)
+	c, err := innerProduct(a, b)
+	require.NoError(t, err)
+
+	// Calculate manually a0*b0 + a1*b1
+	cPrime := a[0].Mul(b[0]).Add(a[1].Mul(b[1]))
+	require.Equal(t, c, cPrime)
+}
+
+func TestSplitListofPointsHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	points := randPointVec(10, *curve)
+	firstHalf, secondHalf, err := splitPointVector(points)
+	require.NoError(t, err)
+	require.Len(t, firstHalf, 5)
+	require.Len(t, secondHalf, 5)
+}
+
+func TestSplitListofPointsOddLength(t *testing.T) {
+	curve := curves.ED25519()
+	points := randPointVec(11, *curve)
+	_, _, err := splitPointVector(points)
+	require.Error(t, err)
+}
+
+func TestSplitListofPointsZeroLength(t *testing.T) {
+	curve := curves.ED25519()
+	points := randPointVec(0, *curve)
+	_, _, err := splitPointVector(points)
+	require.Error(t, err)
+}
+
+func randScalarVec(length int, curve curves.Curve) []curves.Scalar {
+	out := make([]curves.Scalar, length)
+	for i := 0; i < length; i++ {
+		out[i] = curve.Scalar.Random(crand.Reader)
+	}
+	return out
+}
+
+func randPointVec(length int, curve curves.Curve) []curves.Point {
+	out := make([]curves.Point, length)
+	for i := 0; i < length; i++ {
+		out[i] = curve.Point.Random(crand.Reader)
+	}
+	return out
+}

crypto/bulletproof/ipp_prover.go

@@ -0,0 +1,396 @@
+//
+// Copyright Coinbase, Inc. All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+// Package bulletproof implements the zero knowledge protocol bulletproofs as defined in https://eprint.iacr.org/2017/1066.pdf
+package bulletproof
+
+import (
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// InnerProductProver is the struct used to create InnerProductProofs
+// It specifies which curve to use and holds precomputed generators
+// See NewInnerProductProver() for prover initialization.
+type InnerProductProver struct {
+	curve      curves.Curve
+	generators ippGenerators
+}
+
+// InnerProductProof contains necessary output for the inner product proof
+// a and b are the final input vectors of scalars, they should be of length 1
+// Ls and Rs are calculated per recursion of the IPP and are necessary for verification
+// See section 3.1 on pg 15 of https://eprint.iacr.org/2017/1066.pdf
+type InnerProductProof struct {
+	a, b         curves.Scalar
+	capLs, capRs []curves.Point
+	curve        *curves.Curve
+}
+
+// ippRecursion is the same as IPP but tracks recursive a', b', g', h' and Ls and Rs
+// It should only be used internally by InnerProductProver.Prove()
+// See L35 on pg 16 of https://eprint.iacr.org/2017/1066.pdf
+type ippRecursion struct {
+	a, b         []curves.Scalar
+	c            curves.Scalar
+	capLs, capRs []curves.Point
+	g, h         []curves.Point
+	u, capP      curves.Point
+	transcript   *merlin.Transcript
+}
+
+// NewInnerProductProver initializes a new prover
+// It uses the specified domain to generate generators for vectors of at most maxVectorLength
+// A prover can be used to construct inner product proofs for vectors of length less than or equal to maxVectorLength
+// A prover is defined by an explicit curve.
+func NewInnerProductProver(maxVectorLength int, domain []byte, curve curves.Curve) (*InnerProductProver, error) {
+	generators, err := getGeneratorPoints(maxVectorLength, domain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "ipp getGenerators")
+	}
+	return &InnerProductProver{curve: curve, generators: *generators}, nil
+}
+
+// NewInnerProductProof initializes a new InnerProductProof for a specified curve
+// This should be used in tandem with UnmarshalBinary() to convert a marshaled proof into the struct.
+func NewInnerProductProof(curve *curves.Curve) *InnerProductProof {
+	var capLs, capRs []curves.Point
+	newProof := InnerProductProof{
+		a:     curve.NewScalar(),
+		b:     curve.NewScalar(),
+		capLs: capLs,
+		capRs: capRs,
+		curve: curve,
+	}
+	return &newProof
+}
+
+// rangeToIPP takes the output of a range proof and converts it into an inner product proof
+// See section 4.2 on pg 20
+// The conversion specifies generators to use (g and hPrime), as well as the two vectors l, r of which the inner product is tHat
+// Additionally, note that the P used for the IPP is in fact P*h^-mu from the range proof.
+func (prover *InnerProductProver) rangeToIPP(proofG, proofH []curves.Point, l, r []curves.Scalar, tHat curves.Scalar, capPhmuinv, u curves.Point, transcript *merlin.Transcript) (*InnerProductProof, error) {
+	// Note that P as a witness is only g^l * h^r
+	// P needs to be in the form of g^l * h^r * u^<l,r>
+	// Calculate the final P including the u^<l,r> term
+	utHat := u.Mul(tHat)
+	capP := capPhmuinv.Add(utHat)
+
+	// Use params to prove inner product
+	recursionParams := &ippRecursion{
+		a:          l,
+		b:          r,
+		capLs:      []curves.Point{},
+		capRs:      []curves.Point{},
+		c:          tHat,
+		g:          proofG,
+		h:          proofH,
+		capP:       capP,
+		u:          u,
+		transcript: transcript,
+	}
+
+	return prover.proveRecursive(recursionParams)
+}
+
+// getP returns the initial P value given two scalars a,b and point u
+// This method should only be used for testing
+// See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf
+func (prover *InnerProductProver) getP(a, b []curves.Scalar, u curves.Point) (curves.Point, error) {
+	// Vectors must have length power of two
+	if !isPowerOfTwo(len(a)) {
+		return nil, errors.New("ipp vector length must be power of two")
+	}
+	// Generator vectors must be same length
+	if len(prover.generators.G) != len(prover.generators.H) {
+		return nil, errors.New("ipp generator lengths of g and h must be equal")
+	}
+	// Inner product requires len(a) == len(b) else error is returned
+	c, err := innerProduct(a, b)
+	if err != nil {
+		return nil, errors.Wrap(err, "ipp getInnerProduct")
+	}
+
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := prover.generators.G[0:len(a)]
+	proofH := prover.generators.H[0:len(b)]
+
+	// initial P = g^a * h^b * u^(a dot b) (See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf)
+	ga := prover.curve.NewGeneratorPoint().SumOfProducts(proofG, a)
+	hb := prover.curve.NewGeneratorPoint().SumOfProducts(proofH, b)
+	uadotb := u.Mul(c)
+	capP := ga.Add(hb).Add(uadotb)
+
+	return capP, nil
+}
+
+// Prove executes the prover protocol on pg 16 of https://eprint.iacr.org/2017/1066.pdf
+// It generates an inner product proof for vectors a and b, using u to blind the inner product in P
+// A transcript is used for the Fiat Shamir heuristic.
+func (prover *InnerProductProver) Prove(a, b []curves.Scalar, u curves.Point, transcript *merlin.Transcript) (*InnerProductProof, error) {
+	// Vectors must have length power of two
+	if !isPowerOfTwo(len(a)) {
+		return nil, errors.New("ipp vector length must be power of two")
+	}
+	// Generator vectors must be same length
+	if len(prover.generators.G) != len(prover.generators.H) {
+		return nil, errors.New("ipp generator lengths of g and h must be equal")
+	}
+	// Inner product requires len(a) == len(b) else error is returned
+	c, err := innerProduct(a, b)
+	if err != nil {
+		return nil, errors.Wrap(err, "ipp getInnerProduct")
+	}
+
+	// Length of vectors must be less than the number of generators generated
+	if len(a) > len(prover.generators.G) {
+		return nil, errors.New("ipp vector length must be less than maxVectorLength")
+	}
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := prover.generators.G[0:len(a)]
+	proofH := prover.generators.H[0:len(b)]
+
+	// initial P = g^a * h^b * u^(a dot b) (See (3) on page 13 of https://eprint.iacr.org/2017/1066.pdf)
+	ga := prover.curve.NewGeneratorPoint().SumOfProducts(proofG, a)
+	hb := prover.curve.NewGeneratorPoint().SumOfProducts(proofH, b)
+	uadotb := u.Mul(c)
+	capP := ga.Add(hb).Add(uadotb)
+
+	recursionParams := &ippRecursion{
+		a:          a,
+		b:          b,
+		capLs:      []curves.Point{},
+		capRs:      []curves.Point{},
+		c:          c,
+		g:          proofG,
+		h:          proofH,
+		capP:       capP,
+		u:          u,
+		transcript: transcript,
+	}
+	return prover.proveRecursive(recursionParams)
+}
+
+// proveRecursive executes the recursion on pg 16 of https://eprint.iacr.org/2017/1066.pdf
+func (prover *InnerProductProver) proveRecursive(recursionParams *ippRecursion) (*InnerProductProof, error) {
+	// length checks
+	if len(recursionParams.a) != len(recursionParams.b) {
+		return nil, errors.New("ipp proveRecursive a and b different lengths")
+	}
+	if len(recursionParams.g) != len(recursionParams.h) {
+		return nil, errors.New("ipp proveRecursive g and h different lengths")
+	}
+	if len(recursionParams.a) != len(recursionParams.g) {
+		return nil, errors.New("ipp proveRecursive scalar and point vectors different lengths")
+	}
+	// Base case (L14, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	if len(recursionParams.a) == 1 {
+		proof := &InnerProductProof{
+			a:     recursionParams.a[0],
+			b:     recursionParams.b[0],
+			capLs: recursionParams.capLs,
+			capRs: recursionParams.capRs,
+			curve: &prover.curve,
+		}
+		return proof, nil
+	}
+
+	// Split current state into low (first half) vs high (second half) vectors
+	aLo, aHi, err := splitScalarVector(recursionParams.a)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams splitScalarVector")
+	}
+	bLo, bHi, err := splitScalarVector(recursionParams.b)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams splitScalarVector")
+	}
+	gLo, gHi, err := splitPointVector(recursionParams.g)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams splitPointVector")
+	}
+	hLo, hHi, err := splitPointVector(recursionParams.h)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams splitPointVector")
+	}
+
+	// c_l, c_r (L21,22, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	cL, err := innerProduct(aLo, bHi)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams innerProduct")
+	}
+
+	cR, err := innerProduct(aHi, bLo)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams innerProduct")
+	}
+
+	// L, R (L23,24, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	lga := prover.curve.Point.SumOfProducts(gHi, aLo)
+	lhb := prover.curve.Point.SumOfProducts(hLo, bHi)
+	ucL := recursionParams.u.Mul(cL)
+	capL := lga.Add(lhb).Add(ucL)
+
+	rga := prover.curve.Point.SumOfProducts(gLo, aHi)
+	rhb := prover.curve.Point.SumOfProducts(hHi, bLo)
+	ucR := recursionParams.u.Mul(cR)
+	capR := rga.Add(rhb).Add(ucR)
+
+	// Add L,R for verifier to use to calculate final g, h
+	newL := recursionParams.capLs
+	newL = append(newL, capL)
+	newR := recursionParams.capRs
+	newR = append(newR, capR)
+
+	// Get x from L, R for non-interactive (See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf)
+	// Note this replaces the interactive model, i.e. L36-28 of pg16 of https://eprint.iacr.org/2017/1066.pdf
+	x, err := prover.calcx(capL, capR, recursionParams.transcript)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams calcx")
+	}
+
+	// Calculate recursive inputs
+	xInv, err := x.Invert()
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams x.Invert")
+	}
+
+	// g', h' (L29,30, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	gLoxInverse := multiplyScalarToPointVector(xInv, gLo)
+	gHix := multiplyScalarToPointVector(x, gHi)
+	gPrime, err := multiplyPairwisePointVectors(gLoxInverse, gHix)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams multiplyPairwisePointVectors")
+	}
+
+	hLox := multiplyScalarToPointVector(x, hLo)
+	hHixInv := multiplyScalarToPointVector(xInv, hHi)
+	hPrime, err := multiplyPairwisePointVectors(hLox, hHixInv)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams multiplyPairwisePointVectors")
+	}
+
+	// P' (L31, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	xSquare := x.Square()
+	xInvSquare := xInv.Square()
+	LxSquare := capL.Mul(xSquare)
+	RxInvSquare := capR.Mul(xInvSquare)
+	PPrime := LxSquare.Add(recursionParams.capP).Add(RxInvSquare)
+
+	// a', b' (L33, 34, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	aLox := multiplyScalarToScalarVector(x, aLo)
+	aHixIn := multiplyScalarToScalarVector(xInv, aHi)
+	aPrime, err := addPairwiseScalarVectors(aLox, aHixIn)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams addPairwiseScalarVectors")
+	}
+
+	bLoxInv := multiplyScalarToScalarVector(xInv, bLo)
+	bHix := multiplyScalarToScalarVector(x, bHi)
+	bPrime, err := addPairwiseScalarVectors(bLoxInv, bHix)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams addPairwiseScalarVectors")
+	}
+
+	// c'
+	cPrime, err := innerProduct(aPrime, bPrime)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams innerProduct")
+	}
+
+	// Make recursive call (L35, pg16 of https://eprint.iacr.org/2017/1066.pdf)
+	recursiveIPP := &ippRecursion{
+		a:          aPrime,
+		b:          bPrime,
+		capLs:      newL,
+		capRs:      newR,
+		c:          cPrime,
+		g:          gPrime,
+		h:          hPrime,
+		capP:       PPrime,
+		u:          recursionParams.u,
+		transcript: recursionParams.transcript,
+	}
+
+	out, err := prover.proveRecursive(recursiveIPP)
+	if err != nil {
+		return nil, errors.Wrap(err, "recursionParams proveRecursive")
+	}
+	return out, nil
+}
+
+// calcx uses a merlin transcript for Fiat Shamir
+// For each recursion, it takes the current state of the transcript and appends the newly calculated L and R values
+// A new scalar is then read from the transcript
+// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
+func (prover *InnerProductProver) calcx(capL, capR curves.Point, transcript *merlin.Transcript) (curves.Scalar, error) {
+	// Add the newest capL and capR values to transcript
+	transcript.AppendMessage([]byte("addRecursiveL"), capL.ToAffineUncompressed())
+	transcript.AppendMessage([]byte("addRecursiveR"), capR.ToAffineUncompressed())
+	// Read 64 bytes from, set to scalar
+	outBytes := transcript.ExtractBytes([]byte("getx"), 64)
+	x, err := prover.curve.NewScalar().SetBytesWide(outBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
+	}
+
+	return x, nil
+}
+
+// MarshalBinary takes an inner product proof and marshals into bytes.
+func (proof *InnerProductProof) MarshalBinary() []byte {
+	var out []byte
+	out = append(out, proof.a.Bytes()...)
+	out = append(out, proof.b.Bytes()...)
+	for i, capLElem := range proof.capLs {
+		capRElem := proof.capRs[i]
+		out = append(out, capLElem.ToAffineCompressed()...)
+		out = append(out, capRElem.ToAffineCompressed()...)
+	}
+	return out
+}
+
+// UnmarshalBinary takes bytes of a marshaled proof and writes them into an inner product proof
+// The inner product proof used should be from the output of NewInnerProductProof().
+func (proof *InnerProductProof) UnmarshalBinary(data []byte) error {
+	scalarLen := len(proof.curve.NewScalar().Bytes())
+	pointLen := len(proof.curve.NewGeneratorPoint().ToAffineCompressed())
+	ptr := 0
+	// Get scalars
+	a, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
+	if err != nil {
+		return errors.New("innerProductProof UnmarshalBinary SetBytes")
+	}
+	proof.a = a
+	ptr += scalarLen
+	b, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
+	if err != nil {
+		return errors.New("innerProductProof UnmarshalBinary SetBytes")
+	}
+	proof.b = b
+	ptr += scalarLen
+	// Get points
+	var capLs, capRs []curves.Point //nolint:prealloc // pointer arithmetic makes it too unreadable.
+	for ptr < len(data) {
+		capLElem, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+		if err != nil {
+			return errors.New("innerProductProof UnmarshalBinary FromAffineCompressed")
+		}
+		capLs = append(capLs, capLElem)
+		ptr += pointLen
+		capRElem, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+		if err != nil {
+			return errors.New("innerProductProof UnmarshalBinary FromAffineCompressed")
+		}
+		capRs = append(capRs, capRElem)
+		ptr += pointLen
+	}
+	proof.capLs = capLs
+	proof.capRs = capRs
+
+	return nil
+}

crypto/bulletproof/ipp_prover_test.go

@@ -0,0 +1,99 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestIPPHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(8, *curve)
+	b := randScalarVec(8, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(a, b, u, transcript)
+	require.NoError(t, err)
+	require.Equal(t, 3, len(proof.capLs))
+	require.Equal(t, 3, len(proof.capRs))
+}
+
+func TestIPPMismatchedVectors(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(4, *curve)
+	b := randScalarVec(8, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.Prove(a, b, u, transcript)
+	require.Error(t, err)
+}
+
+func TestIPPNonPowerOfTwoLengthVectors(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(3, *curve)
+	b := randScalarVec(3, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.Prove(a, b, u, transcript)
+	require.Error(t, err)
+}
+
+func TestIPPZeroLengthVectors(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(0, *curve)
+	b := randScalarVec(0, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.Prove(a, b, u, transcript)
+	require.Error(t, err)
+}
+
+func TestIPPGreaterThanMaxLengthVectors(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(16, *curve)
+	b := randScalarVec(16, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.Prove(a, b, u, transcript)
+	require.Error(t, err)
+}
+
+func TestIPPMarshal(t *testing.T) {
+	curve := curves.ED25519()
+	prover, err := NewInnerProductProver(8, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(8, *curve)
+	b := randScalarVec(8, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(a, b, u, transcript)
+	require.NoError(t, err)
+
+	proofMarshaled := proof.MarshalBinary()
+	proofPrime := NewInnerProductProof(curve)
+	err = proofPrime.UnmarshalBinary(proofMarshaled)
+	require.NoError(t, err)
+	require.Zero(t, proof.a.Cmp(proofPrime.a))
+	require.Zero(t, proof.b.Cmp(proofPrime.b))
+	for i, proofCapLElem := range proof.capLs {
+		proofPrimeCapLElem := proofPrime.capLs[i]
+		require.True(t, proofCapLElem.Equal(proofPrimeCapLElem))
+		proofCapRElem := proof.capRs[i]
+		proofPrimeCapRElem := proofPrime.capRs[i]
+		require.True(t, proofCapRElem.Equal(proofPrimeCapRElem))
+	}
+}

crypto/bulletproof/ipp_verifier.go

@@ -0,0 +1,209 @@
+package bulletproof
+
+import (
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// InnerProductVerifier is the struct used to verify inner product proofs
+// It specifies which curve to use and holds precomputed generators
+// See NewInnerProductProver() for prover initialization.
+type InnerProductVerifier struct {
+	curve      curves.Curve
+	generators ippGenerators
+}
+
+// NewInnerProductVerifier initializes a new verifier
+// It uses the specified domain to generate generators for vectors of at most maxVectorLength
+// A verifier can be used to verify inner product proofs for vectors of length less than or equal to maxVectorLength
+// A verifier is defined by an explicit curve.
+func NewInnerProductVerifier(maxVectorLength int, domain []byte, curve curves.Curve) (*InnerProductVerifier, error) {
+	generators, err := getGeneratorPoints(maxVectorLength, domain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "ipp getGenerators")
+	}
+	return &InnerProductVerifier{curve: curve, generators: *generators}, nil
+}
+
+// Verify verifies the given proof inputs
+// It implements the final comparison of section 3.1 on pg17 of https://eprint.iacr.org/2017/1066.pdf
+func (verifier *InnerProductVerifier) Verify(capP, u curves.Point, proof *InnerProductProof, transcript *merlin.Transcript) (bool, error) {
+	if len(proof.capLs) != len(proof.capRs) {
+		return false, errors.New("ipp capLs and capRs must be same length")
+	}
+	// Generator vectors must be same length
+	if len(verifier.generators.G) != len(verifier.generators.H) {
+		return false, errors.New("ipp generator lengths of g and h must be equal")
+	}
+
+	// Get generators for each elem in a, b and one more for u
+	// len(Ls) = log n, therefore can just exponentiate
+	n := 1 << len(proof.capLs)
+
+	// Length of vectors must be less than the number of generators generated
+	if n > len(verifier.generators.G) {
+		return false, errors.New("ipp vector length must be less than maxVectorLength")
+	}
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := verifier.generators.G[0:n]
+	proofH := verifier.generators.H[0:n]
+
+	xs, err := getxs(transcript, proof.capLs, proof.capRs, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "verifier getxs")
+	}
+	s, err := verifier.getsNew(xs, n)
+	if err != nil {
+		return false, errors.Wrap(err, "verifier getss")
+	}
+	lhs, err := verifier.getLHS(u, proof, proofG, proofH, s)
+	if err != nil {
+		return false, errors.Wrap(err, "verify getLHS")
+	}
+	rhs, err := verifier.getRHS(capP, proof, xs)
+	if err != nil {
+		return false, errors.Wrap(err, "verify getRHS")
+	}
+	return lhs.Equal(rhs), nil
+}
+
+// Verify verifies the given proof inputs
+// It implements the final comparison of section 3.1 on pg17 of https://eprint.iacr.org/2017/1066.pdf
+func (verifier *InnerProductVerifier) VerifyFromRangeProof(proofG, proofH []curves.Point, capPhmuinv, u curves.Point, tHat curves.Scalar, proof *InnerProductProof, transcript *merlin.Transcript) (bool, error) {
+	// Get generators for each elem in a, b and one more for u
+	// len(Ls) = log n, therefore can just exponentiate
+	n := 1 << len(proof.capLs)
+
+	xs, err := getxs(transcript, proof.capLs, proof.capRs, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "verifier getxs")
+	}
+	s, err := verifier.gets(xs, n)
+	if err != nil {
+		return false, errors.Wrap(err, "verifier getss")
+	}
+	lhs, err := verifier.getLHS(u, proof, proofG, proofH, s)
+	if err != nil {
+		return false, errors.Wrap(err, "verify getLHS")
+	}
+	utHat := u.Mul(tHat)
+	capP := capPhmuinv.Add(utHat)
+	rhs, err := verifier.getRHS(capP, proof, xs)
+	if err != nil {
+		return false, errors.Wrap(err, "verify getRHS")
+	}
+	return lhs.Equal(rhs), nil
+}
+
+// getRHS gets the right hand side of the final comparison of section 3.1 on pg17.
+func (*InnerProductVerifier) getRHS(capP curves.Point, proof *InnerProductProof, xs []curves.Scalar) (curves.Point, error) {
+	product := capP
+	for j, Lj := range proof.capLs {
+		Rj := proof.capRs[j]
+		xj := xs[j]
+		xjSquare := xj.Square()
+		xjSquareInv, err := xjSquare.Invert()
+		if err != nil {
+			return nil, errors.Wrap(err, "verify invert")
+		}
+		LjxjSquare := Lj.Mul(xjSquare)
+		RjxjSquareInv := Rj.Mul(xjSquareInv)
+		product = product.Add(LjxjSquare).Add(RjxjSquareInv)
+	}
+	return product, nil
+}
+
+// getLHS gets the left hand side of the final comparison of section 3.1 on pg17.
+func (verifier *InnerProductVerifier) getLHS(u curves.Point, proof *InnerProductProof, g, h []curves.Point, s []curves.Scalar) (curves.Point, error) {
+	sInv, err := invertScalars(s)
+	if err != nil {
+		return nil, errors.Wrap(err, "verify invertScalars")
+	}
+	// g^(a*s)
+	as := multiplyScalarToScalarVector(proof.a, s)
+	gas := verifier.curve.Point.SumOfProducts(g, as)
+	// h^(b*s^-1)
+	bsInv := multiplyScalarToScalarVector(proof.b, sInv)
+	hbsInv := verifier.curve.Point.SumOfProducts(h, bsInv)
+	// u^a*b
+	ab := proof.a.Mul(proof.b)
+	uab := u.Mul(ab)
+	// g^(a*s) * h^(b*s^-1) * u^a*b
+	out := gas.Add(hbsInv).Add(uab)
+
+	return out, nil
+}
+
+// getxs calculates the x values from Ls and Rs
+// Note that each x is read from the transcript, then the L and R at a certain index are written to the transcript
+// This mirrors the reading of xs and writing of Ls and Rs in the prover.
+func getxs(transcript *merlin.Transcript, capLs, capRs []curves.Point, curve curves.Curve) ([]curves.Scalar, error) {
+	xs := make([]curves.Scalar, len(capLs))
+	for i, capLi := range capLs {
+		capRi := capRs[i]
+		// Add the newest L and R values to transcript
+		transcript.AppendMessage([]byte("addRecursiveL"), capLi.ToAffineUncompressed())
+		transcript.AppendMessage([]byte("addRecursiveR"), capRi.ToAffineUncompressed())
+		// Read 64 bytes from, set to scalar
+		outBytes := transcript.ExtractBytes([]byte("getx"), 64)
+		x, err := curve.NewScalar().SetBytesWide(outBytes)
+		if err != nil {
+			return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
+		}
+		xs[i] = x
+	}
+
+	return xs, nil
+}
+
+// gets calculates the vector s of values used for verification
+// See the second expression of section 3.1 on pg15
+// nolint
+func (verifier *InnerProductVerifier) gets(xs []curves.Scalar, n int) ([]curves.Scalar, error) {
+	ss := make([]curves.Scalar, n)
+	for i := 0; i < n; i++ {
+		si := verifier.curve.Scalar.One()
+		for j, xj := range xs {
+			if i>>(len(xs)-j-1)&0x01 == 1 {
+				si = si.Mul(xj)
+			} else {
+				xjInverse, err := xj.Invert()
+				if err != nil {
+					return nil, errors.Wrap(err, "getss invert")
+				}
+				si = si.Mul(xjInverse)
+			}
+		}
+		ss[i] = si
+	}
+
+	return ss, nil
+}
+
+// getsNew calculates the vector s of values used for verification
+// It provides analogous functionality as gets(), but uses a O(n) algorithm vs O(nlogn)
+// The algorithm inverts all xs, then begins multiplying the inversion by the square of x elements to
+// calculate all s values thus minimizing necessary inversions/ computation.
+func (verifier *InnerProductVerifier) getsNew(xs []curves.Scalar, n int) ([]curves.Scalar, error) {
+	var err error
+	ss := make([]curves.Scalar, n)
+	// First element is all xs inverted mul'd
+	ss[0] = verifier.curve.Scalar.One()
+	for _, xj := range xs {
+		ss[0] = ss[0].Mul(xj)
+	}
+	ss[0], err = ss[0].Invert()
+	if err != nil {
+		return nil, errors.Wrap(err, "ipp gets inv ss0")
+	}
+	for j, xj := range xs {
+		xjSquared := xj.Square()
+		for i := 0; i < n; i += 1 << (len(xs) - j) {
+			ss[i+1<<(len(xs)-j-1)] = ss[i].Mul(xjSquared)
+		}
+	}
+
+	return ss, nil
+}

crypto/bulletproof/ipp_verifier_test.go

@@ -0,0 +1,79 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestIPPVerifyHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	vecLength := 256
+	prover, err := NewInnerProductProver(vecLength, []byte("test"), *curve)
+	require.NoError(t, err)
+	a := randScalarVec(vecLength, *curve)
+	b := randScalarVec(vecLength, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcriptProver := merlin.NewTranscript("test")
+	proof, err := prover.Prove(a, b, u, transcriptProver)
+	require.NoError(t, err)
+
+	verifier, err := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
+	require.NoError(t, err)
+	capP, err := prover.getP(a, b, u)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	verified, err := verifier.Verify(capP, u, proof, transcriptVerifier)
+	require.NoError(t, err)
+	require.True(t, verified)
+}
+
+func BenchmarkIPPVerification(bench *testing.B) {
+	curve := curves.ED25519()
+	vecLength := 1024
+	prover, _ := NewInnerProductProver(vecLength, []byte("test"), *curve)
+	a := randScalarVec(vecLength, *curve)
+	b := randScalarVec(vecLength, *curve)
+	u := curve.Point.Random(crand.Reader)
+	transcriptProver := merlin.NewTranscript("test")
+	proof, _ := prover.Prove(a, b, u, transcriptProver)
+
+	verifier, _ := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
+	capP, _ := prover.getP(a, b, u)
+	transcriptVerifier := merlin.NewTranscript("test")
+	verified, _ := verifier.Verify(capP, u, proof, transcriptVerifier)
+	require.True(bench, verified)
+}
+
+func TestIPPVerifyInvalidProof(t *testing.T) {
+	curve := curves.ED25519()
+	vecLength := 64
+	prover, err := NewInnerProductProver(vecLength, []byte("test"), *curve)
+	require.NoError(t, err)
+
+	a := randScalarVec(vecLength, *curve)
+	b := randScalarVec(vecLength, *curve)
+	u := curve.Point.Random(crand.Reader)
+
+	aPrime := randScalarVec(64, *curve)
+	bPrime := randScalarVec(64, *curve)
+	uPrime := curve.Point.Random(crand.Reader)
+	transcriptProver := merlin.NewTranscript("test")
+
+	proofPrime, err := prover.Prove(aPrime, bPrime, uPrime, transcriptProver)
+	require.NoError(t, err)
+
+	verifier, err := NewInnerProductVerifier(vecLength, []byte("test"), *curve)
+	require.NoError(t, err)
+	capP, err := prover.getP(a, b, u)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	// Check for different capP, u from proof
+	verified, err := verifier.Verify(capP, u, proofPrime, transcriptVerifier)
+	require.NoError(t, err)
+	require.False(t, verified)
+}

crypto/bulletproof/range_batch_prover.go

@@ -0,0 +1,348 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// BatchProve proves that a list of scalars v are in the range n.
+// It implements the aggregating logarithmic proofs defined on pg21.
+// Instead of taking a single value and a single blinding factor, BatchProve takes in a list of values and list of
+// blinding factors.
+func (prover *RangeProver) BatchProve(v, gamma []curves.Scalar, n int, proofGenerators RangeProofGenerators, transcript *merlin.Transcript) (*RangeProof, error) {
+	// Define nm as the total bits required for secrets, calculated as number of secrets * n
+	m := len(v)
+	nm := n * m
+	// nm must be less than or equal to the number of generators generated
+	if nm > len(prover.generators.G) {
+		return nil, errors.New("ipp vector length must be less than or equal to maxVectorLength")
+	}
+
+	// In case where nm is less than number of generators precomputed by prover, trim to length
+	proofG := prover.generators.G[0:nm]
+	proofH := prover.generators.H[0:nm]
+
+	// Check that each elem in v is in range [0, 2^n]
+	for _, vi := range v {
+		checkedRange := checkRange(vi, n)
+		if checkedRange != nil {
+			return nil, checkedRange
+		}
+	}
+
+	// L40 on pg19
+	aL, err := getaLBatched(v, n, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	onenm := get1nVector(nm, prover.curve)
+	// L41 on pg19
+	aR, err := subtractPairwiseScalarVectors(aL, onenm)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	alpha := prover.curve.Scalar.Random(crand.Reader)
+	// Calc A (L44, pg19)
+	halpha := proofGenerators.h.Mul(alpha)
+	gaL := prover.curve.Point.SumOfProducts(proofG, aL)
+	haR := prover.curve.Point.SumOfProducts(proofH, aR)
+	capA := halpha.Add(gaL).Add(haR)
+
+	// L45, 46, pg19
+	sL := getBlindingVector(nm, prover.curve)
+	sR := getBlindingVector(nm, prover.curve)
+	rho := prover.curve.Scalar.Random(crand.Reader)
+
+	// Calc S (L47, pg19)
+	hrho := proofGenerators.h.Mul(rho)
+	gsL := prover.curve.Point.SumOfProducts(proofG, sL)
+	hsR := prover.curve.Point.SumOfProducts(proofH, sR)
+	capS := hrho.Add(gsL).Add(hsR)
+
+	// Fiat Shamir for y,z (L49, pg19)
+	capV := getcapVBatched(v, gamma, proofGenerators.g, proofGenerators.h)
+	y, z, err := calcyzBatched(capV, capA, capS, transcript, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc t_1, t_2
+	// See the l(X), r(X), equations on pg 21
+	// Use l(X)'s and r(X)'s constant and linear terms to derive t_1 and t_2
+	// (a_l - z*1^n)
+	zonenm := multiplyScalarToScalarVector(z, onenm)
+	constantTerml, err := subtractPairwiseScalarVectors(aL, zonenm)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	linearTerml := sL
+
+	// zSum term, see equation 71 on pg21
+	zSum := getSumTermrXBatched(z, n, len(v), prover.curve)
+	// a_r + z*1^nm
+	aRPluszonenm, err := addPairwiseScalarVectors(aR, zonenm)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	ynm := getknVector(y, nm, prover.curve)
+	hadamard, err := multiplyPairwiseScalarVectors(ynm, aRPluszonenm)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	constantTermr, err := addPairwiseScalarVectors(hadamard, zSum)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	linearTermr, err := multiplyPairwiseScalarVectors(ynm, sR)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// t_1 (as the linear coefficient) is the sum of the dot products of l(X)'s linear term dot r(X)'s constant term
+	// and r(X)'s linear term dot l(X)'s constant term
+	t1FirstTerm, err := innerProduct(linearTerml, constantTermr)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t1SecondTerm, err := innerProduct(linearTermr, constantTerml)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t1 := t1FirstTerm.Add(t1SecondTerm)
+
+	// t_2 (as the quadratic coefficient) is the dot product of l(X)'s and r(X)'s linear terms
+	t2, err := innerProduct(linearTerml, linearTermr)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// L52, pg20
+	tau1 := prover.curve.Scalar.Random(crand.Reader)
+	tau2 := prover.curve.Scalar.Random(crand.Reader)
+
+	// T_1, T_2 (L53, pg20)
+	capT1 := proofGenerators.g.Mul(t1).Add(proofGenerators.h.Mul(tau1))
+	capT2 := proofGenerators.g.Mul(t2).Add(proofGenerators.h.Mul(tau2))
+
+	// Fiat shamir for x (L55, pg20)
+	x, err := calcx(capT1, capT2, transcript, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc l
+	// Instead of using the expression in the line, evaluate l() at x
+	sLx := multiplyScalarToScalarVector(x, linearTerml)
+	l, err := addPairwiseScalarVectors(constantTerml, sLx)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc r
+	// Instead of using the expression in the line, evaluate r() at x
+	ynsRx := multiplyScalarToScalarVector(x, linearTermr)
+	r, err := addPairwiseScalarVectors(constantTermr, ynsRx)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc t hat
+	// For efficiency, instead of calculating the dot product, evaluate t() at x
+	zm := getknVector(z, m, prover.curve)
+	zsquarezm := multiplyScalarToScalarVector(z.Square(), zm)
+	sumv := prover.curve.Scalar.Zero()
+	for i := 0; i < m; i++ {
+		elem := zsquarezm[i].Mul(v[i])
+		sumv = sumv.Add(elem)
+	}
+
+	deltayzBatched, err := deltayzBatched(y, z, n, m, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t0 := sumv.Add(deltayzBatched)
+	tLinear := t1.Mul(x)
+	tQuadratic := t2.Mul(x.Square())
+	tHat := t0.Add(tLinear).Add(tQuadratic)
+
+	// Calc tau_x (L61, pg20)
+	tau2xsquare := tau2.Mul(x.Square())
+	tau1x := tau1.Mul(x)
+	zsum := prover.curve.Scalar.Zero()
+	zExp := z.Clone()
+	for j := 1; j < m+1; j++ {
+		zExp = zExp.Mul(z)
+		zsum = zsum.Add(zExp.Mul(gamma[j-1]))
+	}
+	taux := tau2xsquare.Add(tau1x).Add(zsum)
+
+	// Calc mu (L62, pg20)
+	mu := alpha.Add(rho.Mul(x))
+
+	// Calc IPP (See section 4.2)
+	hPrime, err := gethPrime(proofH, y, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// P is redefined in batched case, see bottom equation on pg21.
+	capPhmu := getPhmuBatched(proofG, hPrime, proofGenerators.h, capA, capS, x, y, z, mu, n, m, prover.curve)
+
+	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
+	w, err := prover.curve.NewScalar().SetBytesWide(wBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	ipp, err := prover.ippProver.rangeToIPP(proofG, hPrime, l, r, tHat, capPhmu, proofGenerators.u.Mul(w), transcript)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	out := &RangeProof{
+		capA:  capA,
+		capS:  capS,
+		capT1: capT1,
+		capT2: capT2,
+		taux:  taux,
+		mu:    mu,
+		tHat:  tHat,
+		ipp:   ipp,
+		curve: &prover.curve,
+	}
+	return out, nil
+}
+
+// See final term of L71 on pg 21
+// Sigma_{j=1}^{m} z^{1+j} * (0^{(j-1)*n} || 2^{n} || 0^{(m-j)*n}).
+func getSumTermrXBatched(z curves.Scalar, n, m int, curve curves.Curve) []curves.Scalar {
+	twoN := get2nVector(n, curve)
+	var out []curves.Scalar
+	// The final power should be one more than m
+	zExp := z.Clone()
+	for j := 0; j < m; j++ {
+		zExp = zExp.Mul(z)
+		elem := multiplyScalarToScalarVector(zExp, twoN)
+		out = append(out, elem...)
+	}
+
+	return out
+}
+
+func getcapVBatched(v, gamma []curves.Scalar, g, h curves.Point) []curves.Point {
+	out := make([]curves.Point, len(v))
+	for i, vi := range v {
+		out[i] = getcapV(vi, gamma[i], g, h)
+	}
+	return out
+}
+
+func getaLBatched(v []curves.Scalar, n int, curve curves.Curve) ([]curves.Scalar, error) {
+	var aL []curves.Scalar
+	for _, vi := range v {
+		aLi, err := getaL(vi, n, curve)
+		if err != nil {
+			return nil, err
+		}
+		aL = append(aL, aLi...)
+	}
+	return aL, nil
+}
+
+func calcyzBatched(capV []curves.Point, capA, capS curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, curves.Scalar, error) {
+	// Add the A,S values to transcript
+	for _, capVi := range capV {
+		transcript.AppendMessage([]byte("addV"), capVi.ToAffineUncompressed())
+	}
+	transcript.AppendMessage([]byte("addcapA"), capA.ToAffineUncompressed())
+	transcript.AppendMessage([]byte("addcapS"), capS.ToAffineUncompressed())
+	// Read 64 bytes twice from, set to scalar for y and z
+	yBytes := transcript.ExtractBytes([]byte("gety"), 64)
+	y, err := curve.NewScalar().SetBytesWide(yBytes)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
+	}
+	zBytes := transcript.ExtractBytes([]byte("getz"), 64)
+	z, err := curve.NewScalar().SetBytesWide(zBytes)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
+	}
+
+	return y, z, nil
+}
+
+func deltayzBatched(y, z curves.Scalar, n, m int, curve curves.Curve) (curves.Scalar, error) {
+	// z - z^2
+	zMinuszsquare := z.Sub(z.Square())
+	// 1^(n*m)
+	onenm := get1nVector(n*m, curve)
+	// <1^nm, y^nm>
+	onenmdotynm, err := innerProduct(onenm, getknVector(y, n*m, curve))
+	if err != nil {
+		return nil, errors.Wrap(err, "deltayz")
+	}
+	// (z - z^2)*<1^n, y^n>
+	termFirst := zMinuszsquare.Mul(onenmdotynm)
+
+	// <1^n, 2^n>
+	onendottwon, err := innerProduct(get1nVector(n, curve), get2nVector(n, curve))
+	if err != nil {
+		return nil, errors.Wrap(err, "deltayz")
+	}
+
+	termSecond := curve.Scalar.Zero()
+	zExp := z.Square()
+	for j := 1; j < m+1; j++ {
+		zExp = zExp.Mul(z)
+		elem := zExp.Mul(onendottwon)
+		termSecond = termSecond.Add(elem)
+	}
+
+	// (z - z^2)*<1^n, y^n> - z^3*<1^n, 2^n>
+	out := termFirst.Sub(termSecond)
+
+	return out, nil
+}
+
+// Bottom equation on pg21.
+func getPhmuBatched(proofG, proofHPrime []curves.Point, h, capA, capS curves.Point, x, y, z, mu curves.Scalar, n, m int, curve curves.Curve) curves.Point {
+	twoN := get2nVector(n, curve)
+	// h'^(z*y^n + z^2*2^n)
+	lastElem := curve.NewIdentityPoint()
+	zExp := z.Clone()
+	for j := 1; j < m+1; j++ {
+		// Get subvector of h
+		hSubvector := proofHPrime[(j-1)*n : j*n]
+		// z^(j+1)
+		zExp = zExp.Mul(z)
+		exp := multiplyScalarToScalarVector(zExp, twoN)
+		// Final elem
+		elem := curve.Point.SumOfProducts(hSubvector, exp)
+		lastElem = lastElem.Add(elem)
+	}
+
+	zynm := multiplyScalarToScalarVector(z, getknVector(y, n*m, curve))
+	hPrimezynm := curve.Point.SumOfProducts(proofHPrime, zynm)
+	lastElem = lastElem.Add(hPrimezynm)
+
+	// S^x
+	capSx := capS.Mul(x)
+
+	// g^-z --> -z*<1,g>
+	onenm := get1nVector(n*m, curve)
+	zNeg := z.Neg()
+	zinvonen := multiplyScalarToScalarVector(zNeg, onenm)
+	zgdotonen := curve.Point.SumOfProducts(proofG, zinvonen)
+
+	// L66 on pg20
+	P := capA.Add(capSx).Add(zgdotonen).Add(lastElem)
+	hmu := h.Mul(mu)
+	Phmu := P.Sub(hmu)
+
+	return Phmu
+}

crypto/bulletproof/range_batch_prover_test.go

@@ -0,0 +1,102 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestRangeBatchProverHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.Random(crand.Reader)
+	v2 := curve.Scalar.Random(crand.Reader)
+	v3 := curve.Scalar.Random(crand.Reader)
+	v4 := curve.Scalar.Random(crand.Reader)
+	v := []curves.Scalar{v1, v2, v3, v4}
+
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+	require.NotNil(t, proof)
+	require.Equal(t, 10, len(proof.ipp.capLs))
+	require.Equal(t, 10, len(proof.ipp.capRs))
+}
+
+func TestGetaLBatched(t *testing.T) {
+	curve := curves.ED25519()
+	v1 := curve.Scalar.Random(crand.Reader)
+	v2 := curve.Scalar.Random(crand.Reader)
+	v3 := curve.Scalar.Random(crand.Reader)
+	v4 := curve.Scalar.Random(crand.Reader)
+	v := []curves.Scalar{v1, v2, v3, v4}
+	aL, err := getaLBatched(v, 256, *curve)
+	require.NoError(t, err)
+	twoN := get2nVector(256, *curve)
+	for i := 1; i < len(v)+1; i++ {
+		vec := aL[(i-1)*256 : i*256]
+		product, err := innerProduct(vec, twoN)
+		require.NoError(t, err)
+		require.Zero(t, product.Cmp(v[i-1]))
+	}
+}
+
+func TestRangeBatchProverMarshal(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.Random(crand.Reader)
+	v2 := curve.Scalar.Random(crand.Reader)
+	v3 := curve.Scalar.Random(crand.Reader)
+	v4 := curve.Scalar.Random(crand.Reader)
+	v := []curves.Scalar{v1, v2, v3, v4}
+
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	proofMarshaled := proof.MarshalBinary()
+	proofPrime := NewRangeProof(curve)
+	err = proofPrime.UnmarshalBinary(proofMarshaled)
+	require.NoError(t, err)
+	require.True(t, proof.capA.Equal(proofPrime.capA))
+	require.True(t, proof.capS.Equal(proofPrime.capS))
+	require.True(t, proof.capT1.Equal(proofPrime.capT1))
+	require.True(t, proof.capT2.Equal(proofPrime.capT2))
+	require.Zero(t, proof.taux.Cmp(proofPrime.taux))
+	require.Zero(t, proof.mu.Cmp(proofPrime.mu))
+	require.Zero(t, proof.tHat.Cmp(proofPrime.tHat))
+}

crypto/bulletproof/range_batch_verifier.go

@@ -0,0 +1,91 @@
+package bulletproof
+
+import (
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// VerifyBatched verifies a given batched range proof.
+// It takes in a list of commitments to the secret values as capV instead of a single commitment to a single point
+// when compared to the unbatched single range proof case.
+func (verifier *RangeVerifier) VerifyBatched(proof *RangeProof, capV []curves.Point, proofGenerators RangeProofGenerators, n int, transcript *merlin.Transcript) (bool, error) {
+	// Define nm as the total bits required for secrets, calculated as number of secrets * n
+	m := len(capV)
+	nm := n * m
+	// nm must be less than the number of generators generated
+	if nm > len(verifier.generators.G) {
+		return false, errors.New("ipp vector length must be less than maxVectorLength")
+	}
+
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := verifier.generators.G[0:nm]
+	proofH := verifier.generators.H[0:nm]
+
+	// Calc y,z,x from Fiat Shamir heuristic
+	y, z, err := calcyzBatched(capV, proof.capA, proof.capS, transcript, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	x, err := calcx(proof.capT1, proof.capT2, transcript, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
+	w, err := verifier.curve.NewScalar().SetBytesWide(wBytes)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc delta(y,z), redefined for batched case on pg21
+	deltayzBatched, err := deltayzBatched(y, z, n, m, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	// Check tHat: L65, pg20
+	// See equation 72 on pg21
+	tHatIsValid := verifier.checktHatBatched(proof, capV, proofGenerators.g, proofGenerators.h, deltayzBatched, x, z, m)
+	if !tHatIsValid {
+		return false, errors.New("rangeproof verify tHat is invalid")
+	}
+
+	// Verify IPP
+	hPrime, err := gethPrime(proofH, y, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	capPhmu := getPhmuBatched(proofG, hPrime, proofGenerators.h, proof.capA, proof.capS, x, y, z, proof.mu, n, m, verifier.curve)
+
+	ippVerified, err := verifier.ippVerifier.VerifyFromRangeProof(proofG, hPrime, capPhmu, proofGenerators.u.Mul(w), proof.tHat, proof.ipp, transcript)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	return ippVerified, nil
+}
+
+// L65, pg20.
+func (verifier *RangeVerifier) checktHatBatched(proof *RangeProof, capV []curves.Point, g, h curves.Point, deltayz, x, z curves.Scalar, m int) bool {
+	// g^tHat * h^tau_x
+	gtHat := g.Mul(proof.tHat)
+	htaux := h.Mul(proof.taux)
+	lhs := gtHat.Add(htaux)
+
+	// V^z^2 * g^delta(y,z) * Tau_1^x * Tau_2^x^2
+	// g^delta(y,z) * V^(z^2*z^m) * Tau_1^x * Tau_2^x^2
+	zm := getknVector(z, m, verifier.curve)
+	zsquarezm := multiplyScalarToScalarVector(z.Square(), zm)
+	capVzsquaretwom := verifier.curve.Point.SumOfProducts(capV, zsquarezm)
+	gdeltayz := g.Mul(deltayz)
+	capTau1x := proof.capT1.Mul(x)
+	capTau2xsquare := proof.capT2.Mul(x.Square())
+	rhs := capVzsquaretwom.Add(gdeltayz).Add(capTau1x).Add(capTau2xsquare)
+
+	// Compare lhs =? rhs
+	return lhs.Equal(rhs)
+}

crypto/bulletproof/range_batch_verifier_test.go

@@ -0,0 +1,148 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestRangeBatchVerifyHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.Random(crand.Reader)
+	v2 := curve.Scalar.Random(crand.Reader)
+	v3 := curve.Scalar.Random(crand.Reader)
+	v4 := curve.Scalar.Random(crand.Reader)
+	v := []curves.Scalar{v1, v2, v3, v4}
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	capV := getcapVBatched(v, gamma, g, h)
+	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
+	require.NoError(t, err)
+	require.True(t, verified)
+}
+
+func TestRangeBatchVerifyNotInRange(t *testing.T) {
+	curve := curves.ED25519()
+	n := 2
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.One()
+	v2 := curve.Scalar.Random(crand.Reader)
+	v3 := curve.Scalar.Random(crand.Reader)
+	v4 := curve.Scalar.Random(crand.Reader)
+	v := []curves.Scalar{v1, v2, v3, v4}
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.Error(t, err)
+}
+
+func TestRangeBatchVerifyNonRandom(t *testing.T) {
+	curve := curves.ED25519()
+	n := 2
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.One()
+	v2 := curve.Scalar.One()
+	v3 := curve.Scalar.One()
+	v4 := curve.Scalar.One()
+	v := []curves.Scalar{v1, v2, v3, v4}
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	capV := getcapVBatched(v, gamma, g, h)
+	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
+	require.NoError(t, err)
+	require.True(t, verified)
+}
+
+func TestRangeBatchVerifyInvalid(t *testing.T) {
+	curve := curves.ED25519()
+	n := 2
+	prover, err := NewRangeProver(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v1 := curve.Scalar.One()
+	v2 := curve.Scalar.One()
+	v3 := curve.Scalar.One()
+	v4 := curve.Scalar.One()
+	v := []curves.Scalar{v1, v2, v3, v4}
+	gamma1 := curve.Scalar.Random(crand.Reader)
+	gamma2 := curve.Scalar.Random(crand.Reader)
+	gamma3 := curve.Scalar.Random(crand.Reader)
+	gamma4 := curve.Scalar.Random(crand.Reader)
+	gamma := []curves.Scalar{gamma1, gamma2, gamma3, gamma4}
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.BatchProve(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	verifier, err := NewRangeVerifier(n*4, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	capV := getcapVBatched(v, gamma, g, h)
+	capV[0] = curve.Point.Random(crand.Reader)
+	verified, err := verifier.VerifyBatched(proof, capV, proofGenerators, n, transcriptVerifier)
+	require.Error(t, err)
+	require.False(t, verified)
+}

crypto/bulletproof/range_prover.go

@@ -0,0 +1,476 @@
+//
+// Copyright Coinbase, Inc. All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+// Package bulletproof implements the zero knowledge protocol bulletproofs as defined in https://eprint.iacr.org/2017/1066.pdf
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"math/big"
+
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// RangeProver is the struct used to create RangeProofs
+// It specifies which curve to use and holds precomputed generators
+// See NewRangeProver() for prover initialization.
+type RangeProver struct {
+	curve      curves.Curve
+	generators *ippGenerators
+	ippProver  *InnerProductProver
+}
+
+// RangeProof is the struct used to hold a range proof
+// capA is a commitment to a_L and a_R using randomness alpha
+// capS is a commitment to s_L and s_R using randomness rho
+// capTau1,2 are commitments to t1,t2 respectively using randomness tau_1,2
+// tHat represents t(X) as defined on page 19
+// taux is the blinding factor for tHat
+// ipp is the inner product proof used for compacting the transfer of l,r (See 4.2 on pg20).
+type RangeProof struct {
+	capA, capS, capT1, capT2 curves.Point
+	taux, mu, tHat           curves.Scalar
+	ipp                      *InnerProductProof
+	curve                    *curves.Curve
+}
+
+type RangeProofGenerators struct {
+	g, h, u curves.Point
+}
+
+// NewRangeProver initializes a new prover
+// It uses the specified domain to generate generators for vectors of at most maxVectorLength
+// A prover can be used to construct range proofs for vectors of length less than or equal to maxVectorLength
+// A prover is defined by an explicit curve.
+func NewRangeProver(maxVectorLength int, rangeDomain, ippDomain []byte, curve curves.Curve) (*RangeProver, error) {
+	generators, err := getGeneratorPoints(maxVectorLength, rangeDomain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "range NewRangeProver")
+	}
+	ippProver, err := NewInnerProductProver(maxVectorLength, ippDomain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "range NewRangeProver")
+	}
+	return &RangeProver{curve: curve, generators: generators, ippProver: ippProver}, nil
+}
+
+// NewRangeProof initializes a new RangeProof for a specified curve
+// This should be used in tandem with UnmarshalBinary() to convert a marshaled proof into the struct.
+func NewRangeProof(curve *curves.Curve) *RangeProof {
+	out := RangeProof{
+		capA:  nil,
+		capS:  nil,
+		capT1: nil,
+		capT2: nil,
+		taux:  nil,
+		mu:    nil,
+		tHat:  nil,
+		ipp:   NewInnerProductProof(curve),
+		curve: curve,
+	}
+
+	return &out
+}
+
+// Prove uses the range prover to prove that some value v is within the range [0, 2^n]
+// It implements the protocol defined on pgs 19,20 in https://eprint.iacr.org/2017/1066.pdf
+// v is the value of which to prove the range
+// n is the power that specifies the upper bound of the range, ie. 2^n
+// gamma is a scalar used for as a blinding factor
+// g, h, u are unique points used as generators for the blinding factor
+// transcript is a merlin transcript to be used for the fiat shamir heuristic.
+func (prover *RangeProver) Prove(v, gamma curves.Scalar, n int, proofGenerators RangeProofGenerators, transcript *merlin.Transcript) (*RangeProof, error) {
+	// n must be less than or equal to the number of generators generated
+	if n > len(prover.generators.G) {
+		return nil, errors.New("ipp vector length must be less than or equal to maxVectorLength")
+	}
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := prover.generators.G[0:n]
+	proofH := prover.generators.H[0:n]
+
+	// Check that v is in range [0, 2^n]
+	if bigZero := big.NewInt(0); v.BigInt().Cmp(bigZero) == -1 {
+		return nil, errors.New("v is less than 0")
+	}
+
+	bigTwo := big.NewInt(2)
+	if n < 0 {
+		return nil, errors.New("n cannot be less than 0")
+	}
+	bigN := big.NewInt(int64(n))
+	var bigTwoToN big.Int
+	bigTwoToN.Exp(bigTwo, bigN, nil)
+	if v.BigInt().Cmp(&bigTwoToN) == 1 {
+		return nil, errors.New("v is greater than 2^n")
+	}
+
+	// L40 on pg19
+	aL, err := getaL(v, n, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	onen := get1nVector(n, prover.curve)
+	// L41 on pg19
+	aR, err := subtractPairwiseScalarVectors(aL, onen)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	alpha := prover.curve.Scalar.Random(crand.Reader)
+	// Calc A (L44, pg19)
+	halpha := proofGenerators.h.Mul(alpha)
+	gaL := prover.curve.Point.SumOfProducts(proofG, aL)
+	haR := prover.curve.Point.SumOfProducts(proofH, aR)
+	capA := halpha.Add(gaL).Add(haR)
+
+	// L45, 46, pg19
+	sL := getBlindingVector(n, prover.curve)
+	sR := getBlindingVector(n, prover.curve)
+	rho := prover.curve.Scalar.Random(crand.Reader)
+
+	// Calc S (L47, pg19)
+	hrho := proofGenerators.h.Mul(rho)
+	gsL := prover.curve.Point.SumOfProducts(proofG, sL)
+	hsR := prover.curve.Point.SumOfProducts(proofH, sR)
+	capS := hrho.Add(gsL).Add(hsR)
+
+	// Fiat Shamir for y,z (L49, pg19)
+	capV := getcapV(v, gamma, proofGenerators.g, proofGenerators.h)
+	y, z, err := calcyz(capV, capA, capS, transcript, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc t_1, t_2
+	// See the l(X), r(X), t(X) equations on pg 19
+	// Use l(X)'s and r(X)'s constant and linear terms to derive t_1 and t_2
+	// (a_l - z*1^n)
+	zonen := multiplyScalarToScalarVector(z, onen)
+	constantTerml, err := subtractPairwiseScalarVectors(aL, zonen)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	linearTerml := sL
+
+	// z^2 * 2^N
+	twoN := get2nVector(n, prover.curve)
+	zSquareTwon := multiplyScalarToScalarVector(z.Square(), twoN)
+	// a_r + z*1^n
+	aRPluszonen, err := addPairwiseScalarVectors(aR, zonen)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	yn := getknVector(y, n, prover.curve)
+	hadamard, err := multiplyPairwiseScalarVectors(yn, aRPluszonen)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	constantTermr, err := addPairwiseScalarVectors(hadamard, zSquareTwon)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	linearTermr, err := multiplyPairwiseScalarVectors(yn, sR)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// t_1 (as the linear coefficient) is the sum of the dot products of l(X)'s linear term dot r(X)'s constant term
+	// and r(X)'s linear term dot l(X)'s constant term
+	t1FirstTerm, err := innerProduct(linearTerml, constantTermr)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t1SecondTerm, err := innerProduct(linearTermr, constantTerml)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t1 := t1FirstTerm.Add(t1SecondTerm)
+
+	// t_2 (as the quadratic coefficient) is the dot product of l(X)'s and r(X)'s linear terms
+	t2, err := innerProduct(linearTerml, linearTermr)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// L52, pg20
+	tau1 := prover.curve.Scalar.Random(crand.Reader)
+	tau2 := prover.curve.Scalar.Random(crand.Reader)
+
+	// T_1, T_2 (L53, pg20)
+	capT1 := proofGenerators.g.Mul(t1).Add(proofGenerators.h.Mul(tau1))
+	capT2 := proofGenerators.g.Mul(t2).Add(proofGenerators.h.Mul(tau2))
+
+	// Fiat shamir for x (L55, pg20)
+	x, err := calcx(capT1, capT2, transcript, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc l (L58, pg20)
+	// Instead of using the expression in the line, evaluate l() at x
+	sLx := multiplyScalarToScalarVector(x, linearTerml)
+	l, err := addPairwiseScalarVectors(constantTerml, sLx)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc r (L59, pg20)
+	// Instead of using the expression in the line, evaluate r() at x
+	ynsRx := multiplyScalarToScalarVector(x, linearTermr)
+	r, err := addPairwiseScalarVectors(constantTermr, ynsRx)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc t hat (L60, pg20)
+	// For efficiency, instead of calculating the dot product, evaluate t() at x
+	deltayz, err := deltayz(y, z, n, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+	t0 := v.Mul(z.Square()).Add(deltayz)
+	tLinear := t1.Mul(x)
+	tQuadratic := t2.Mul(x.Square())
+	tHat := t0.Add(tLinear).Add(tQuadratic)
+
+	// Calc tau_x (L61, pg20)
+	tau2xsquare := tau2.Mul(x.Square())
+	tau1x := tau1.Mul(x)
+	zsquaregamma := z.Square().Mul(gamma)
+	taux := tau2xsquare.Add(tau1x).Add(zsquaregamma)
+
+	// Calc mu (L62, pg20)
+	mu := alpha.Add(rho.Mul(x))
+
+	// Calc IPP (See section 4.2)
+	hPrime, err := gethPrime(proofH, y, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	capPhmu, err := getPhmu(proofG, hPrime, proofGenerators.h, capA, capS, x, y, z, mu, n, prover.curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
+	w, err := prover.curve.NewScalar().SetBytesWide(wBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	ipp, err := prover.ippProver.rangeToIPP(proofG, hPrime, l, r, tHat, capPhmu, proofGenerators.u.Mul(w), transcript)
+	if err != nil {
+		return nil, errors.Wrap(err, "rangeproof prove")
+	}
+
+	out := &RangeProof{
+		capA:  capA,
+		capS:  capS,
+		capT1: capT1,
+		capT2: capT2,
+		taux:  taux,
+		mu:    mu,
+		tHat:  tHat,
+		ipp:   ipp,
+		curve: &prover.curve,
+	}
+	return out, nil
+}
+
+// MarshalBinary takes a range proof and marshals into bytes.
+func (proof *RangeProof) MarshalBinary() []byte {
+	var out []byte
+	out = append(out, proof.capA.ToAffineCompressed()...)
+	out = append(out, proof.capS.ToAffineCompressed()...)
+	out = append(out, proof.capT1.ToAffineCompressed()...)
+	out = append(out, proof.capT2.ToAffineCompressed()...)
+	out = append(out, proof.taux.Bytes()...)
+	out = append(out, proof.mu.Bytes()...)
+	out = append(out, proof.tHat.Bytes()...)
+	out = append(out, proof.ipp.MarshalBinary()...)
+
+	return out
+}
+
+// UnmarshalBinary takes bytes of a marshaled proof and writes them into a range proof
+// The range proof used should be from the output of NewRangeProof().
+func (proof *RangeProof) UnmarshalBinary(data []byte) error {
+	scalarLen := len(proof.curve.NewScalar().Bytes())
+	pointLen := len(proof.curve.NewGeneratorPoint().ToAffineCompressed())
+	ptr := 0
+	// Get points
+	capA, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
+	}
+	proof.capA = capA
+	ptr += pointLen
+	capS, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
+	}
+	proof.capS = capS
+	ptr += pointLen
+	capT1, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
+	}
+	proof.capT1 = capT1
+	ptr += pointLen
+	capT2, err := proof.curve.Point.FromAffineCompressed(data[ptr : ptr+pointLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary FromAffineCompressed")
+	}
+	proof.capT2 = capT2
+	ptr += pointLen
+
+	// Get scalars
+	taux, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary SetBytes")
+	}
+	proof.taux = taux
+	ptr += scalarLen
+	mu, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary SetBytes")
+	}
+	proof.mu = mu
+	ptr += scalarLen
+	tHat, err := proof.curve.NewScalar().SetBytes(data[ptr : ptr+scalarLen])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary SetBytes")
+	}
+	proof.tHat = tHat
+	ptr += scalarLen
+
+	// Get IPP
+	err = proof.ipp.UnmarshalBinary(data[ptr:])
+	if err != nil {
+		return errors.New("rangeProof UnmarshalBinary")
+	}
+
+	return nil
+}
+
+// checkRange validates whether some scalar v is within the range [0, 2^n - 1]
+// It will return an error if v is less than 0 or greater than 2^n - 1
+// Otherwise it will return nil.
+func checkRange(v curves.Scalar, n int) error {
+	bigOne := big.NewInt(1)
+	if n < 0 {
+		return errors.New("n cannot be less than 0")
+	}
+	var bigTwoToN big.Int
+	bigTwoToN.Lsh(bigOne, uint(n))
+	if v.BigInt().Cmp(&bigTwoToN) == 1 {
+		return errors.New("v is greater than 2^n")
+	}
+
+	return nil
+}
+
+// getBlindingVector returns a vector of scalars used as blinding factors for commitments.
+func getBlindingVector(length int, curve curves.Curve) []curves.Scalar {
+	vec := make([]curves.Scalar, length)
+	for i := 0; i < length; i++ {
+		vec[i] = curve.Scalar.Random(crand.Reader)
+	}
+	return vec
+}
+
+// getcapV returns a commitment to v using blinding factor gamma.
+func getcapV(v, gamma curves.Scalar, g, h curves.Point) curves.Point {
+	return h.Mul(gamma).Add(g.Mul(v))
+}
+
+// getaL obtains the bit vector representation of v
+// See the a_L definition towards the bottom of pg 17 of https://eprint.iacr.org/2017/1066.pdf
+func getaL(v curves.Scalar, n int, curve curves.Curve) ([]curves.Scalar, error) {
+	var err error
+
+	vBytes := v.Bytes()
+	zero := curve.Scalar.Zero()
+	one := curve.Scalar.One()
+	aL := make([]curves.Scalar, n)
+	for j := 0; j < len(aL); j++ {
+		aL[j] = zero
+	}
+	for i := 0; i < n; i++ {
+		ithBit := vBytes[i>>3] >> (i & 0x07) & 0x01
+		aL[i], err = cmoveScalar(zero, one, int(ithBit), curve)
+		if err != nil {
+			return nil, errors.Wrap(err, "getaL")
+		}
+	}
+
+	return aL, nil
+}
+
+// cmoveScalar provides a constant time operation that returns x if which is 0 and returns y if which is 1.
+func cmoveScalar(x, y curves.Scalar, which int, curve curves.Curve) (curves.Scalar, error) {
+	if which != 0 && which != 1 {
+		return nil, errors.New("cmoveScalar which must be 0 or 1")
+	}
+	mask := -byte(which)
+	xBytes := x.Bytes()
+	yBytes := y.Bytes()
+	for i, xByte := range xBytes {
+		xBytes[i] ^= (xByte ^ yBytes[i]) & mask
+	}
+	out, err := curve.NewScalar().SetBytes(xBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "cmoveScalar SetBytes")
+	}
+
+	return out, nil
+}
+
+// calcyz uses a merlin transcript for Fiat Shamir
+// It takes the current state of the transcript and appends the newly calculated capA and capS values
+// Two new scalars are then read from the transcript
+// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
+func calcyz(capV, capA, capS curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, curves.Scalar, error) {
+	// Add the A,S values to transcript
+	transcript.AppendMessage([]byte("addV"), capV.ToAffineUncompressed())
+	transcript.AppendMessage([]byte("addcapA"), capA.ToAffineUncompressed())
+	transcript.AppendMessage([]byte("addcapS"), capS.ToAffineUncompressed())
+	// Read 64 bytes twice from, set to scalar for y and z
+	yBytes := transcript.ExtractBytes([]byte("gety"), 64)
+	y, err := curve.NewScalar().SetBytesWide(yBytes)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
+	}
+	zBytes := transcript.ExtractBytes([]byte("getz"), 64)
+	z, err := curve.NewScalar().SetBytesWide(zBytes)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "calcyz NewScalar SetBytesWide")
+	}
+
+	return y, z, nil
+}
+
+// calcx uses a merlin transcript for Fiat Shamir
+// It takes the current state of the transcript and appends the newly calculated capT1 and capT2 values
+// A new scalar is then read from the transcript
+// See section 4.4 pg22 of https://eprint.iacr.org/2017/1066.pdf
+func calcx(capT1, capT2 curves.Point, transcript *merlin.Transcript, curve curves.Curve) (curves.Scalar, error) {
+	// Add the Tau1,2 values to transcript
+	transcript.AppendMessage([]byte("addcapT1"), capT1.ToAffineUncompressed())
+	transcript.AppendMessage([]byte("addcapT2"), capT2.ToAffineUncompressed())
+	// Read 64 bytes from, set to scalar
+	outBytes := transcript.ExtractBytes([]byte("getx"), 64)
+	x, err := curve.NewScalar().SetBytesWide(outBytes)
+	if err != nil {
+		return nil, errors.Wrap(err, "calcx NewScalar SetBytesWide")
+	}
+
+	return x, nil
+}

crypto/bulletproof/range_prover_test.go

@@ -0,0 +1,86 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestRangeProverHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v := curve.Scalar.Random(crand.Reader)
+	gamma := curve.Scalar.Random(crand.Reader)
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+	require.NotNil(t, proof)
+	require.Equal(t, 8, len(proof.ipp.capLs))
+	require.Equal(t, 8, len(proof.ipp.capRs))
+}
+
+func TestGetaL(t *testing.T) {
+	curve := curves.ED25519()
+	v := curve.Scalar.Random(crand.Reader)
+	aL, err := getaL(v, 256, *curve)
+	require.NoError(t, err)
+	twoN := get2nVector(256, *curve)
+	product, err := innerProduct(aL, twoN)
+	require.NoError(t, err)
+	require.Zero(t, product.Cmp(v))
+}
+
+func TestCmove(t *testing.T) {
+	curve := curves.ED25519()
+	two := curve.Scalar.One().Double()
+	four := two.Double()
+	out, err := cmoveScalar(two, four, 1, *curve)
+	require.NoError(t, err)
+	require.Zero(t, out.Cmp(four))
+}
+
+func TestRangeProverMarshal(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v := curve.Scalar.Random(crand.Reader)
+	gamma := curve.Scalar.Random(crand.Reader)
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	proofMarshaled := proof.MarshalBinary()
+	proofPrime := NewRangeProof(curve)
+	err = proofPrime.UnmarshalBinary(proofMarshaled)
+	require.NoError(t, err)
+	require.True(t, proof.capA.Equal(proofPrime.capA))
+	require.True(t, proof.capS.Equal(proofPrime.capS))
+	require.True(t, proof.capT1.Equal(proofPrime.capT1))
+	require.True(t, proof.capT2.Equal(proofPrime.capT2))
+	require.Zero(t, proof.taux.Cmp(proofPrime.taux))
+	require.Zero(t, proof.mu.Cmp(proofPrime.mu))
+	require.Zero(t, proof.tHat.Cmp(proofPrime.tHat))
+}

crypto/bulletproof/range_verifier.go

@@ -0,0 +1,187 @@
+package bulletproof
+
+import (
+	"github.com/gtank/merlin"
+	"github.com/pkg/errors"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+// RangeVerifier is the struct used to verify RangeProofs
+// It specifies which curve to use and holds precomputed generators
+// See NewRangeVerifier() for verifier initialization.
+type RangeVerifier struct {
+	curve       curves.Curve
+	generators  *ippGenerators
+	ippVerifier *InnerProductVerifier
+}
+
+// NewRangeVerifier initializes a new verifier
+// It uses the specified domain to generate generators for vectors of at most maxVectorLength
+// A verifier can be used to verify range proofs for vectors of length less than or equal to maxVectorLength
+// A verifier is defined by an explicit curve.
+func NewRangeVerifier(maxVectorLength int, rangeDomain, ippDomain []byte, curve curves.Curve) (*RangeVerifier, error) {
+	generators, err := getGeneratorPoints(maxVectorLength, rangeDomain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "range NewRangeProver")
+	}
+	ippVerifier, err := NewInnerProductVerifier(maxVectorLength, ippDomain, curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "range NewRangeProver")
+	}
+	return &RangeVerifier{curve: curve, generators: generators, ippVerifier: ippVerifier}, nil
+}
+
+// Verify verifies the given range proof inputs
+// It implements the checking of L65 on pg 20
+// It also verifies the dot product of <l,r> using the inner product proof\
+// capV is a commitment to v using blinding factor gamma
+// n is the power that specifies the upper bound of the range, ie. 2^n
+// g, h, u are unique points used as generators for the blinding factor
+// transcript is a merlin transcript to be used for the fiat shamir heuristic.
+func (verifier *RangeVerifier) Verify(proof *RangeProof, capV curves.Point, proofGenerators RangeProofGenerators, n int, transcript *merlin.Transcript) (bool, error) {
+	// Length of vectors must be less than the number of generators generated
+	if n > len(verifier.generators.G) {
+		return false, errors.New("ipp vector length must be less than maxVectorLength")
+	}
+	// In case where len(a) is less than number of generators precomputed by prover, trim to length
+	proofG := verifier.generators.G[0:n]
+	proofH := verifier.generators.H[0:n]
+
+	// Calc y,z,x from Fiat Shamir heuristic
+	y, z, err := calcyz(capV, proof.capA, proof.capS, transcript, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	x, err := calcx(proof.capT1, proof.capT2, transcript, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	wBytes := transcript.ExtractBytes([]byte("getw"), 64)
+	w, err := verifier.curve.NewScalar().SetBytesWide(wBytes)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof prove")
+	}
+
+	// Calc delta(y,z)
+	deltayz, err := deltayz(y, z, n, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	// Check tHat: L65, pg20
+	tHatIsValid := verifier.checktHat(proof, capV, proofGenerators.g, proofGenerators.h, deltayz, x, z)
+	if !tHatIsValid {
+		return false, errors.New("rangeproof verify tHat is invalid")
+	}
+
+	// Verify IPP
+	hPrime, err := gethPrime(proofH, y, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	capPhmu, err := getPhmu(proofG, hPrime, proofGenerators.h, proof.capA, proof.capS, x, y, z, proof.mu, n, verifier.curve)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	ippVerified, err := verifier.ippVerifier.VerifyFromRangeProof(proofG, hPrime, capPhmu, proofGenerators.u.Mul(w), proof.tHat, proof.ipp, transcript)
+	if err != nil {
+		return false, errors.Wrap(err, "rangeproof verify")
+	}
+
+	return ippVerified, nil
+}
+
+// L65, pg20.
+func (*RangeVerifier) checktHat(proof *RangeProof, capV, g, h curves.Point, deltayz, x, z curves.Scalar) bool {
+	// g^tHat * h^tau_x
+	gtHat := g.Mul(proof.tHat)
+	htaux := h.Mul(proof.taux)
+	lhs := gtHat.Add(htaux)
+
+	// V^z^2 * g^delta(y,z) * Tau_1^x * Tau_2^x^2
+	capVzsquare := capV.Mul(z.Square())
+	gdeltayz := g.Mul(deltayz)
+	capTau1x := proof.capT1.Mul(x)
+	capTau2xsquare := proof.capT2.Mul(x.Square())
+	rhs := capVzsquare.Add(gdeltayz).Add(capTau1x).Add(capTau2xsquare)
+
+	// Compare lhs =? rhs
+	return lhs.Equal(rhs)
+}
+
+// gethPrime calculates new h prime generators as defined in L64 on pg20.
+func gethPrime(h []curves.Point, y curves.Scalar, curve curves.Curve) ([]curves.Point, error) {
+	hPrime := make([]curves.Point, len(h))
+	yInv, err := y.Invert()
+	yInvn := getknVector(yInv, len(h), curve)
+	if err != nil {
+		return nil, errors.Wrap(err, "gethPrime")
+	}
+	for i, hElem := range h {
+		hPrime[i] = hElem.Mul(yInvn[i])
+	}
+	return hPrime, nil
+}
+
+// Obtain P used for IPP verification
+// See L67 on pg20
+// Note P on L66 includes blinding factor hmu, this method removes that factor.
+func getPhmu(proofG, proofHPrime []curves.Point, h, capA, capS curves.Point, x, y, z, mu curves.Scalar, n int, curve curves.Curve) (curves.Point, error) {
+	// h'^(z*y^n + z^2*2^n)
+	zyn := multiplyScalarToScalarVector(z, getknVector(y, n, curve))
+	zsquaretwon := multiplyScalarToScalarVector(z.Square(), get2nVector(n, curve))
+	elemLastExponent, err := addPairwiseScalarVectors(zyn, zsquaretwon)
+	if err != nil {
+		return nil, errors.Wrap(err, "getPhmu")
+	}
+	lastElem := curve.Point.SumOfProducts(proofHPrime, elemLastExponent)
+
+	// S^x
+	capSx := capS.Mul(x)
+
+	// g^-z --> -z*<1,g>
+	onen := get1nVector(n, curve)
+	zNeg := z.Neg()
+	zinvonen := multiplyScalarToScalarVector(zNeg, onen)
+	zgdotonen := curve.Point.SumOfProducts(proofG, zinvonen)
+
+	// L66 on pg20
+	P := capA.Add(capSx).Add(zgdotonen).Add(lastElem)
+	hmu := h.Mul(mu)
+	Phmu := P.Sub(hmu)
+
+	return Phmu, nil
+}
+
+// Delta function for delta(y,z), See (39) on pg18.
+func deltayz(y, z curves.Scalar, n int, curve curves.Curve) (curves.Scalar, error) {
+	// z - z^2
+	zMinuszsquare := z.Sub(z.Square())
+	// 1^n
+	onen := get1nVector(n, curve)
+	// <1^n, y^n>
+	onendotyn, err := innerProduct(onen, getknVector(y, n, curve))
+	if err != nil {
+		return nil, errors.Wrap(err, "deltayz")
+	}
+	// (z - z^2)*<1^n, y^n>
+	termFirst := zMinuszsquare.Mul(onendotyn)
+
+	// <1^n, 2^n>
+	onendottwon, err := innerProduct(onen, get2nVector(n, curve))
+	if err != nil {
+		return nil, errors.Wrap(err, "deltayz")
+	}
+	// z^3*<1^n, 2^n>
+	termSecond := z.Cube().Mul(onendottwon)
+
+	// (z - z^2)*<1^n, y^n> - z^3*<1^n, 2^n>
+	out := termFirst.Sub(termSecond)
+
+	return out, nil
+}

crypto/bulletproof/range_verifier_test.go

@@ -0,0 +1,87 @@
+package bulletproof
+
+import (
+	crand "crypto/rand"
+	"testing"
+
+	"github.com/gtank/merlin"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onsonr/hway/crypto/core/curves"
+)
+
+func TestRangeVerifyHappyPath(t *testing.T) {
+	curve := curves.ED25519()
+	n := 256
+	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v := curve.Scalar.Random(crand.Reader)
+	gamma := curve.Scalar.Random(crand.Reader)
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	verifier, err := NewRangeVerifier(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	capV := getcapV(v, gamma, g, h)
+	verified, err := verifier.Verify(proof, capV, proofGenerators, n, transcriptVerifier)
+	require.NoError(t, err)
+	require.True(t, verified)
+}
+
+func TestRangeVerifyNotInRange(t *testing.T) {
+	curve := curves.ED25519()
+	n := 2
+	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v := curve.Scalar.Random(crand.Reader)
+	gamma := curve.Scalar.Random(crand.Reader)
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	_, err = prover.Prove(v, gamma, n, proofGenerators, transcript)
+	require.Error(t, err)
+}
+
+func TestRangeVerifyNonRandom(t *testing.T) {
+	curve := curves.ED25519()
+	n := 2
+	prover, err := NewRangeProver(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	v := curve.Scalar.One()
+	gamma := curve.Scalar.Random(crand.Reader)
+	g := curve.Point.Random(crand.Reader)
+	h := curve.Point.Random(crand.Reader)
+	u := curve.Point.Random(crand.Reader)
+	proofGenerators := RangeProofGenerators{
+		g: g,
+		h: h,
+		u: u,
+	}
+	transcript := merlin.NewTranscript("test")
+	proof, err := prover.Prove(v, gamma, n, proofGenerators, transcript)
+	require.NoError(t, err)
+
+	verifier, err := NewRangeVerifier(n, []byte("rangeDomain"), []byte("ippDomain"), *curve)
+	require.NoError(t, err)
+	transcriptVerifier := merlin.NewTranscript("test")
+	capV := getcapV(v, gamma, g, h)
+	verified, err := verifier.Verify(proof, capV, proofGenerators, n, transcriptVerifier)
+	require.NoError(t, err)
+	require.True(t, verified)
+}