Skip to content

Commit

Permalink
dprint
Browse files Browse the repository at this point in the history
  • Loading branch information
@Boog900
Boog900 committed Dec 23, 2023
1 parent 56ac06c commit 4145608
Show file tree
Hide file tree
Showing 5 changed files with 38 additions and 41 deletions.
14 changes: 7 additions & 7 deletions src/consensus_rules/ring_ct.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,8 @@ Data needed so the receiver can recover the amount they have received.
2. [Simple Types Rules](#simple-types-rules)
3. [MLSAG Rules](./ring_ct/mlsag.md)
4. [Borromean Rules](./ring_ct/borromean.md)
4. [Bulletproofs Rules](./ring_ct/bulletproofs.md)
4. [Bulletproofs+ Rules](./ring_ct/bulletproofs+.md)
5. [Bulletproofs Rules](./ring_ct/bulletproofs.md)
6. [Bulletproofs+ Rules](./ring_ct/bulletproofs+.md)

## Rules That Apply To All Types

Expand All @@ -40,10 +40,10 @@ RingCT type define the proofs used in the transaction, the ringCT types allowed
| 4 (Bulletproof2) | Uses the same signatures as type 3 | 10 [^bulletproof2-activated-bulletproof-disallowed] | 14 (except 2 transactions) [^clsag-activated-bulletproof2-disallowed] |
| 5 (CLSAG) | CLSAG signatures per input with a single bulletproof for all outputs | 13 [^clsag-activated-bulletproof2-disallowed] | 16 [^bulletproof+-activated-clsag-disallowed] |
| 6 (Bulletproof+) | CLSAG signatures per input with a single bulletproof+ for all outputs | 15 [^bulletproof+-activated-clsag-disallowed] | Still allowed |
| 6+ | Future type not currently allowed | Not allowed [^future-rct-types] | Not allowed |
| 6+ | Future type not currently allowed | Not allowed [^future-rct-types] | Not allowed |

There are 2 type 4 RCT transactions that are allowed after hard-fork 13, this was due to a bug in which transactions added to the txpool before a fork
were not being checked for new fork rules they are:
There are 2 type 4 RCT transactions that are allowed after hard-fork 13, this was due to a bug in which transactions added to the txpool before a fork
were not being checked for new fork rules they are:
`c5151944f0583097ba0c88cd0f43e7fabb3881278aa2f73b3b0a007c5d34e910` and `6f2f117cde6fbcf8d4a6ef8974fcac744726574ac38cf25d3322c996b21edd4c`[^grandfathered-txs].

### OutPKs Valid Points
Expand All @@ -56,7 +56,7 @@ All outputs must have an amount of 0.[zero-amount-outputs]

---

## Simple Types Rules
## Simple Types Rules

These rules apply to all RCT "simple" types, which are all except type "FULL".

Expand Down Expand Up @@ -91,7 +91,7 @@ got activated

[zero-amount-outputs]: <https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/src/cryptonote_core/blockchain.cpp#L3059>

[^outPKs-valid-points]: For simple types: <https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/src/ringct/rctSigs.cpp#L1444>,
[^outPKs-valid-points]: For simple types: <https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/src/ringct/rctSigs.cpp#L1444>,
For type FULL: <https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/src/ringct/rctSigs.cpp#L829-L829>

[^pseudo-outs-valid-points]: <https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/src/ringct/rctSigs.cpp#L1449>
Expand Down
6 changes: 3 additions & 3 deletions src/consensus_rules/ring_ct/borromean.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,16 +16,16 @@ For a range proof at a certain index the sum of each Ci must equal the outPK at

### Borromean Scalar Encoding

Monero does not check that the scalars `s0` and `s1` are reduced this leads to them, if not reduced, being interpreted as a different scalar by the `slide` function
which calculates the 5-NAF of the number. The `slide` function restricts it's output to 256 bytes however if the last bit is set on the input this could lead to the
Monero does not check that the scalars `s0` and `s1` are reduced this leads to them, if not reduced, being interpreted as a different scalar by the `slide` function
which calculates the 5-NAF of the number. The `slide` function restricts it's output to 256 bytes however if the last bit is set on the input this could lead to the
5-NAF of the scalar being 257 bytes long. There are scalars on the chain which have this behavior.[^scalar-report]

The scalar `ee` must be a fully reduced scalar as it is compared against the raw bytes of an output from the `hash_to_scalar` function.[^s0-s1-ee-encoding]

### The Borromean Ring Must Be Valid

To verify a Borromean ring signature is valid you must first set up the public keys that the ring will be verified with, one member of the ring will be a Ci the
other will be (\\(Ci - H * 2^X \\)), where X is the index of the Ci. By setting up the ring like this the prover will only know the discreet log of a
other will be (\\(Ci - H * 2^X \\)), where X is the index of the Ci. By setting up the ring like this the prover will only know the discreet log of a
ring member if either the Ci is a commitment to 0 or \\(2^X\\)[^public-key-setup].

After setting up the public keys the actual borromean rings must be valid.[^ring-valid]
Expand Down
7 changes: 3 additions & 4 deletions src/consensus_rules/ring_ct/bulletproofs+.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ These rules apply to all ringCT types that use bulletproofs+.

### L & R Length

The Length of the L & R fields must be the same, they must both be greater than or equal to 6 and less than or equal to \\( 6 + log_2(maxOutputs) \\),
The Length of the L & R fields must be the same, they must both be greater than or equal to 6 and less than or equal to \\( 6 + log_2(maxOutputs) \\),
maxOutputs being 16.[^L-R-Size]

### Number Of Bulletproofs
Expand All @@ -21,7 +21,7 @@ The amount of outputs in the transaction must not be more than \\(2^{(len(L) - 6

### Canonical Encoding

`r1`, `s2`, `d1` must all be canonically encoded, reduced, scalars.[^scalars-reduced] All the points of `V`, `L` and `R` must be canonically encoded and `A1`, `B` and
`r1`, `s2`, `d1` must all be canonically encoded, reduced, scalars.[^scalars-reduced] All the points of `V`, `L` and `R` must be canonically encoded and `A1`, `B` and
`A` must canonically encoded points.[^canonical-points]

### At Least One Output
Expand All @@ -30,8 +30,7 @@ There must be at least one element of V, which is constructed from the outPKs wh

### The Bulletproof Must Be Valid

The bulletproof must pass verification. [^bulletproof+-valid]
---
## The bulletproof must pass verification. [^bulletproof+-valid]

[^L-R-Size]: <https://github.com/monero-project/monero/blob/master/src/ringct/rctTypes.cpp#L300-L304>

Expand Down
4 changes: 2 additions & 2 deletions src/consensus_rules/ring_ct/bulletproofs.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ These rules apply to all ringCT types that use bulletproofs.

### L & R Length

The Length of the L & R fields must be the same, they must both be greater than or equal to 6 and less than or equal to \\( 6 + log_2(maxOutputs) \\),
The Length of the L & R fields must be the same, they must both be greater than or equal to 6 and less than or equal to \\( 6 + log_2(maxOutputs) \\),
maxOutputs being 16.[^L-R-Size]

### Number Of Bulletproofs
Expand All @@ -31,7 +31,7 @@ All the elements of `V`, `L`, `R` and `A`, `T1`, `T2` and `S` must all be valid,

### The Bulletproof Must Be Valid

The bulletproof must pass verification. [^bulletproof-valid]
The bulletproof must pass verification. [^bulletproof-valid]

---

Expand Down
48 changes: 23 additions & 25 deletions src/consensus_rules/ring_ct/mlsag.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

## Introduction

These rules are split into 3 sections: Full, Simple and Both. Full is for RCT type Full and Simple are for the other RCT types
These rules are split into 3 sections: Full, Simple and Both. Full is for RCT type Full and Simple are for the other RCT types
that use MLSAG signatures.

> Simple is not just for RCT type Simple!
Expand All @@ -18,21 +18,20 @@ that use MLSAG signatures.

For RCT type full the ring matrix contains every inputs ring members: [^full-matrix]

(The signer owns a whole column)
(The signer owns a whole column)

```bob
.-------.-------.-------.- - - -.
| I1 R1 | I1 R2 | I1 R3 | ..... |
| I2 R1 | I2 R2 | I2 R3 | ..... |
| I3 R1 | I3 R2 | I3 R3 | ..... |
..... ..... ..... .....
| A | A | A | ..... | <-.
'-------'-------'-------'-------' |
|
I = Input |
R = Ring member |
A = Pedersen Commitment |
.-------.-------.-------.- - - -.
| I1 R1 | I1 R2 | I1 R3 | ..... |
| I2 R1 | I2 R2 | I2 R3 | ..... |
| I3 R1 | I3 R2 | I3 R3 | ..... |
..... ..... ..... .....
| A | A | A | ..... | <-.
'-------'-------'-------'-------' |
|
I = Input |
R = Ring member |
A = Pedersen Commitment |
```

The last row contains: \\(\sum CommitmentsAtIndex - \sum outPK - fee * H \\) [^full-last-row]
Expand All @@ -55,15 +54,14 @@ There must be the same amount of ring members in each inputs ring.[^full-numb-ri
For simple RCT types the ring matrix only contains the ring members of a single input: [^simple-matrix]

```bob
.-------.-------.-------.- - - -.
| IX R1 | IX R2 | IX R3 | ..... |
| A | A | A | ..... | <-.
'-------'-------'-------'- - - -' |
|
I = Input |
R = Ring member |
A = Pedersen Commitment |
.-------.-------.-------.- - - -.
| IX R1 | IX R2 | IX R3 | ..... |
| A | A | A | ..... | <-.
'-------'-------'-------'- - - -' |
|
I = Input |
R = Ring member |
A = Pedersen Commitment |
```

The last row contains the ring members commitment minus the pseudo-out for this input.[^simple-last-row]
Expand All @@ -76,11 +74,11 @@ There must be more than one ring member.[^more-than-one-ring-member]

### SS Size

The ss field must be the same length as the key matrix[^ss-size] and each ss member lengths must be the same as the matrix's rows. [^ss-member-size]
The ss field must be the same length as the key matrix[^ss-size] and each ss member lengths must be the same as the matrix's rows. [^ss-member-size]

### SS, CC Canonical Encoding

Every ss element and cc must be fully reduced scalars.[^ss-cc-reduced]
Every ss element and cc must be fully reduced scalars.[^ss-cc-reduced]

### Key Images Not Identity

Expand Down

0 comments on commit 4145608

Please sign in to comment.