3

I am reading the source code of Monero. In the Bulletproof prover, there is always a line like T1 = rct::scalarmultKey(T1, INV_EIGHT). Why is there always a INV_EIGHT multiplication with the point? Can anyone help me? Thank you.

Improve this question

2 Answers 2

Reset to default
2

For security reasons, input points should be multiples of 8. While there is no known exploit if they're not in this case, having them be multiples of 8 means we can rule those out in the first place. The obvious way to ensure this is to check whether input points are multiples of 8 in the verification code. However, this is slow. Multiplying a point by 8 turns out to be much faster, so the prover will multiply its final points by 1/8, then the verifier will multiply by 8, thereby restoring the original points. This allows the verifier to ensure its input points are all multiples of 8 while still being fast.

Improve this answer
4
  • Sir, I don't quite understand what you are saying, can you please give more details? Thank you!
    – Felix LL
    Commented Nov 27, 2018 at 12:12
  • An example with integers (this uses integer arithmetic, but bulletproofs use modulo arithmetic): you want only multiples of 8, so you need to weed out, eg, 3. Imagine testing for 1234567 is slow, but multiplying by 8 is fast. What you do is ask the sender to give you an eigth of the value, and you multiply by 8. The sender wants to send 3, but can't, since you will now multiply by 8. There's no integer the sender can send which will yield 3 once you multiply by 8. So the sender can send 0, 1, 2, 3, 4... and you'll get 0, 8, 16, 25, 32... all of which are multiples of 8, which is what you want.
    – user36303
    Commented Nov 27, 2018 at 13:20
  • Sir, can you please give me any reference about this? Thank you.
    – Felix LL
    Commented Dec 19, 2018 at 13:35
  • If you mean some more in depth explanation somewhere, I don't know of any, sorry.
    – user36303
    Commented Dec 21, 2018 at 21:15
1

T1 is a curve point. It is multiplied by 8 to ensure it is on the main subgroup of the Ed25519 curve.

Improve this answer
3
  • Sir, can you please give me any reference about this? Thank you
    – Felix LL
    Commented Dec 24, 2018 at 3:12
  • The Quarkslab audit breaks down the implementation well.
    – jtgrassie
    Commented Dec 24, 2018 at 3:44
  • And this answer on why 8.
    – jtgrassie
    Commented Dec 24, 2018 at 23:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.