I am reading the source code of Monero. In the Bulletproof prover, there is always a line like T1 = rct::scalarmultKey(T1, INV_EIGHT). Why is there always a INV_EIGHT multiplication with the point? Can anyone help me? Thank you.


For security reasons, input points should be multiples of 8. While there is no known exploit if they're not in this case, having them be multiples of 8 means we can rule those out in the first place. The obvious way to ensure this is to check whether input points are multiples of 8 in the verification code. However, this is slow. Multiplying a point by 8 turns out to be much faster, so the prover will multiply its final points by 1/8, then the verifier will multiply by 8, thereby restoring the original points. This allows the verifier to ensure its input points are all multiples of 8 while still being fast.

  • Sir, I don't quite understand what you are saying, can you please give more details? Thank you! – Felix LL Nov 27 '18 at 12:12
  • An example with integers (this uses integer arithmetic, but bulletproofs use modulo arithmetic): you want only multiples of 8, so you need to weed out, eg, 3. Imagine testing for 1234567 is slow, but multiplying by 8 is fast. What you do is ask the sender to give you an eigth of the value, and you multiply by 8. The sender wants to send 3, but can't, since you will now multiply by 8. There's no integer the sender can send which will yield 3 once you multiply by 8. So the sender can send 0, 1, 2, 3, 4... and you'll get 0, 8, 16, 25, 32... all of which are multiples of 8, which is what you want. – user36303 Nov 27 '18 at 13:20
  • Sir, can you please give me any reference about this? Thank you. – Felix LL Dec 19 '18 at 13:35
  • If you mean some more in depth explanation somewhere, I don't know of any, sorry. – user36303 Dec 21 '18 at 21:15

T1 is a curve point. It is multiplied by 8 to ensure it is on the main subgroup of the Ed25519 curve.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.