Use FCMP implementation of BP+ in monero-serai (#344)

* Add in an implementation of BP+ based off the paper, intended for clarity and review

This was done as part of my work on FCMPs from Monero, and is copied from https://github.com/kayabaNerve/full-chain-membership-proofs

* Remove crate structure of BP+

* Remove arithmetic circuit code

* Remove AC/VC generators code

* Remove generator transcript

Monero uses non-transcripted static generators.

* Further trimming of generators

* Remove the single range proof

It's unused by Monero and accordingly unhelpful.

* Work on getting BP+ to compile in its new env

* Correct BP+ folder name

* Further tweaks to get closer to compiling

* Remove the ScalarMatrix file

It's only used for AC proofs

* Compiles, with tests passing

* Lock BP+ to Ed25519 instead of the generic Ciphersuite

* Resolve most warnings in BP+

* Make existing bulletproofs test easier to read

* Further strip generators

* Swap G/H as Monero did

* Replace RangeCommitment with Commitment

* Hard-code BP+ h to Ed25519's generator

* Use pub(crate) for BP+, not pub

* Replace initial_transcript with hash_plus

* Rename hash_plus to initial_transcript

* Finish integrating the FCMP BP+ impl

* Move BP+ folder

* Correct no-std support

* Rename "long_n" to eta

* Add note on non-prime order dfg points

coins/monero/src/tests/bulletproofs/mod.rs

@@ -9,6 +9,8 @@ use crate::{
   ringct::bulletproofs::{Bulletproofs, original::OriginalStruct},
 };
 
+mod plus;
+
 #[test]
 fn bulletproofs_vector() {
   let scalar = |scalar| Scalar::from_canonical_bytes(scalar).unwrap();
@@ -62,7 +64,7 @@ macro_rules! bulletproofs_tests {
     fn $name() {
       // Create Bulletproofs for all possible output quantities
       let mut verifier = BatchVerifier::new(16);
-      for i in 1 .. 17 {
+      for i in 1 ..= 16 {
         let commitments = (1 ..= i)
           .map(|i| Commitment::new(random_scalar(&mut OsRng), u64::try_from(i).unwrap()))
           .collect::<Vec<_>>();

coins/monero/src/tests/bulletproofs/plus/aggregate_range_proof.rs

@@ -0,0 +1,30 @@
+use rand_core::{RngCore, OsRng};
+
+use multiexp::BatchVerifier;
+use group::ff::Field;
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use crate::{
+  Commitment,
+  ringct::bulletproofs::plus::aggregate_range_proof::{
+    AggregateRangeStatement, AggregateRangeWitness,
+  },
+};
+
+#[test]
+fn test_aggregate_range_proof() {
+  let mut verifier = BatchVerifier::new(16);
+  for m in 1 ..= 16 {
+    let mut commitments = vec![];
+    for _ in 0 .. m {
+      commitments.push(Commitment::new(*Scalar::random(&mut OsRng), OsRng.next_u64()));
+    }
+    let commitment_points = commitments.iter().map(|com| EdwardsPoint(com.calculate())).collect();
+    let statement = AggregateRangeStatement::new(commitment_points).unwrap();
+    let witness = AggregateRangeWitness::new(&commitments).unwrap();
+
+    let proof = statement.clone().prove(&mut OsRng, witness).unwrap();
+    statement.verify(&mut OsRng, &mut verifier, (), proof);
+  }
+  assert!(verifier.verify_vartime());
+}

coins/monero/src/tests/bulletproofs/plus/mod.rs

@@ -0,0 +1,4 @@
+#[cfg(test)]
+mod weighted_inner_product;
+#[cfg(test)]
+mod aggregate_range_proof;

coins/monero/src/tests/bulletproofs/plus/weighted_inner_product.rs

@@ -0,0 +1,82 @@
+// The inner product relation is P = sum(g_bold * a, h_bold * b, g * (a * y * b), h * alpha)
+
+use rand_core::OsRng;
+
+use multiexp::BatchVerifier;
+use group::{ff::Field, Group};
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use crate::ringct::bulletproofs::plus::{
+  ScalarVector, PointVector, GeneratorsList, Generators,
+  weighted_inner_product::{WipStatement, WipWitness},
+  weighted_inner_product,
+};
+
+#[test]
+fn test_zero_weighted_inner_product() {
+  #[allow(non_snake_case)]
+  let P = EdwardsPoint::identity();
+  let y = Scalar::random(&mut OsRng);
+
+  let generators = Generators::new().reduce(1);
+  let statement = WipStatement::new(generators, P, y);
+  let witness = WipWitness::new(ScalarVector::new(1), ScalarVector::new(1), Scalar::ZERO).unwrap();
+
+  let transcript = Scalar::random(&mut OsRng);
+  let proof = statement.clone().prove(&mut OsRng, transcript, witness).unwrap();
+
+  let mut verifier = BatchVerifier::new(1);
+  statement.verify(&mut OsRng, &mut verifier, (), transcript, proof);
+  assert!(verifier.verify_vartime());
+}
+
+#[test]
+fn test_weighted_inner_product() {
+  // P = sum(g_bold * a, h_bold * b, g * (a * y * b), h * alpha)
+  let mut verifier = BatchVerifier::new(6);
+  let generators = Generators::new();
+  for i in [1, 2, 4, 8, 16, 32] {
+    let generators = generators.reduce(i);
+    let g = generators.g();
+    let h = generators.h();
+    assert_eq!(generators.len(), i);
+    let mut g_bold = vec![];
+    let mut h_bold = vec![];
+    for i in 0 .. i {
+      g_bold.push(generators.generator(GeneratorsList::GBold1, i));
+      h_bold.push(generators.generator(GeneratorsList::HBold1, i));
+    }
+    let g_bold = PointVector(g_bold);
+    let h_bold = PointVector(h_bold);
+
+    let mut a = ScalarVector::new(i);
+    let mut b = ScalarVector::new(i);
+    let alpha = Scalar::random(&mut OsRng);
+
+    let y = Scalar::random(&mut OsRng);
+    let mut y_vec = ScalarVector::new(g_bold.len());
+    y_vec[0] = y;
+    for i in 1 .. y_vec.len() {
+      y_vec[i] = y_vec[i - 1] * y;
+    }
+
+    for i in 0 .. i {
+      a[i] = Scalar::random(&mut OsRng);
+      b[i] = Scalar::random(&mut OsRng);
+    }
+
+    #[allow(non_snake_case)]
+    let P = g_bold.multiexp(&a) +
+      h_bold.multiexp(&b) +
+      (g * weighted_inner_product(&a, &b, &y_vec)) +
+      (h * alpha);
+
+    let statement = WipStatement::new(generators, P, y);
+    let witness = WipWitness::new(a, b, alpha).unwrap();
+
+    let transcript = Scalar::random(&mut OsRng);
+    let proof = statement.clone().prove(&mut OsRng, transcript, witness).unwrap();
+    statement.verify(&mut OsRng, &mut verifier, (), transcript, proof);
+  }
+  assert!(verifier.verify_vartime());
+}