hello good day :)

i don't see G and H nowhere there.

i assume the "systemwide" G and H = H(g) is used, right?

They are defined in src/ringct/rctTypes.h.

A comment there also say how H is derived.

i have seen that before.

I'm just guessing that bulletproof_PROVE uses G and H; as defined in the rctTypes.h ?

i don't know what a[] and b[] are .

Arrays (pointers really).

f(int a[]) means f(int*) really. Just expected to point to more than one.

page 16

what is the a[] and b[] ?

where is G[n] calculated?

slave_blocker: they are in there: just search rct::H and rct::G

const rct::key Gi = get_exponent(rct::H, i * 2 + 1);

nice

thanks

:)

so

The :: operator is called the scope-resolution operator and does just that, it resolves scope. So, by prefixing a type-name with this, it tells your compiler to look in the global namespace for the type.

rct::H

is therefore systemwide:)

slave_blocker: no, ::rct::H would be systemwide

so what does the syntax for rct::H mean?

rct is a struct ? and H is a part of the struct?

or rct is a class?

<slave_blocker> "so what does the syntax for rct:..." <- en.cppreference.com/w/cpp/language/qualified_lookup, ::rct::H is doing global lookup (avoids any ambiguity), rct::H may fail if there is some ambiguity

rct is a namespace, H is a static variable defined in a header rctOps.h in the rct namespace, when you include that header then your including file acquires rct::H as a file-scope static variable

the scope-resolution qualifier without any prefix is the global scope, if there is a prefix then it is a namespace or class

in ztm on page 137, the transaction has 7 entries for L and for R.

why is that?

is this size always the same for every type of tx?

does L and R receive 3 entries ++; for every output?

slave_blocker: section 5.5 footnote 11

log 2 (64 · p)

what does that mean ?

p stands for the output amount?

i mean the amount of outputs.

yes

i see

so on page 137, there are 2 outputs hence p=2, log(128) = 7...

?

what ?

so having 5 outputs or 6 outputs leads to the same size in L and R of 9 elements ?

so when t(x) is calculated = l(x) * r(x), thats how much the expression evaluates to formally? how many elements are in t_0 t_1 and t_2 ?

aprime[i] = l[i];

bprime[i] = r[i];

i don't see how l[i] and r[i], is filled?

but i < MN, so the number is static... that does not have to do with L and R...

UkoeHB, l[i] is different from L[i] right? l has the size MN and L has the size log(64 * p)?

but the proof leads to the verification itself, because of the fiat-shamir ...

ah !

so in the case of ztm v2, there are 7 "proofs" being done! and each proof is one element in each L and R ???

slave_blocker: idk much about the inner workings of BP

:|

noooo

:(...

oh my

<slave_blocker> " const rct::key Gi = get_expo..." <- Right, yet this doesn't actually return an exponent. Instead it returns hash_to_point(H || i) or so