Bulletproofs

https://github.com/zkcrypto/bulletproofs
Admin
Bulletproofs is a fast implementation of zero-knowledge range proofs and a programmable constraint...
Tokens:109,833
Snippets:151
Trust Score:6.7
License:MIT
Update:1 year ago
Show doc for...
Tokens:
Raw
### Rust Feature Compilation Example

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Example command for compiling benchmarks with the 'avx2_backend' feature enabled, specifying the target CPU for Skylake processors.

```text
RUSTFLAGS="-C target_cpu=skylake" cargo bench --features "avx2_backend"
```

--------------------------------

### Rust Range Proof Example

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Demonstrates the creation and verification of a 32-bit range proof using the Bulletproofs library. It includes setup with Ristretto, Pedersen generators, and Merlin transcripts.

```rust
# // The #-commented lines are hidden in Rustdoc but not in raw
# // markdown rendering, and contain boilerplate code so that the
# // code in the README.md is actually run as part of the test suite.
#
# extern crate rand;
# use rand::thread_rng;
#
# extern crate curve25519_dalek;
# use curve25519_dalek::scalar::Scalar;
#
# extern crate merlin;
# use merlin::Transcript;
#
# extern crate bulletproofs;
# use bulletproofs::{BulletproofGens, PedersenGens, RangeProof};
#

```

--------------------------------

### Rust Nightly Installation

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Instructions for installing the nightly version of Rust using rustup, which is required for compiling the Bulletproofs project.

```text
rustup default nightly
```

--------------------------------

### Rust Feature Compilation Example (Skylake-AVX512)

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Example command for compiling benchmarks with the 'avx2_backend' feature enabled, specifying the target CPU for Skylake-X processors with AVX512 support.

```text
RUSTFLAGS="-C target_cpu=skylake-avx512" cargo bench --features "avx2_backend"
```

--------------------------------

### Install Rustfmt for Pinned Nightly Toolchain

Source: https://github.com/zkcrypto/bulletproofs/blob/main/CONTRIBUTING.md

Installs the `rustfmt` component for the specific nightly Rust toolchain pinned by the `bulletproofs` repository, which is required for enforcing code style in CI.

```shell
rustup component add rustfmt-preview
```

--------------------------------

### ShuffleProof Proving and Verification in Rust

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/r1cs-docs-example.md

Demonstrates the process of creating and verifying a ShuffleProof. The `prove` function generates the proof, and the `verify` function checks its validity against commitments and a transcript. The example includes setup with Pedersen and Bulletproof generators and uses a transcript for commitment.

```rust
use bulletproofs::r1cs::{ConstraintSystem, Verifier, Prover};
use bulletproofs::{BulletproofGens, PedersenGens, R1CSError};
use curve25519_dalek::scalar::Scalar;
use curve25519_dalek::ristretto::CompressedRistretto;
use merlin::Transcript;

// Placeholder for ShuffleProof struct and its methods
struct ShuffleProof(bulletproofs::r1cs::Proof);

impl ShuffleProof {
    /// Attempt to prove a shuffle.
    pub fn prove<'a, 'b>(
        pc_gens: &'b PedersenGens,
        bp_gens: &'b BulletproofGens,
        transcript: &'a mut Transcript,
        inputs: &[Scalar],
        outputs: &[Scalar],
    ) -> Result<(ShuffleProof, Vec<CompressedRistretto>, Vec<CompressedRistretto>),
             R1CSError> {
        // Placeholder for proving logic
        let proof = unimplemented!();
        let input_commitments = unimplemented!();
        let output_commitments = unimplemented!();
        Ok((ShuffleProof(proof), input_commitments, output_commitments))
    }

    /// Attempt to verify a `ShuffleProof`.
    pub fn verify<'a, 'b>(
        &self,
        pc_gens: &'b PedersenGens,
        bp_gens: &'b BulletproofGens,
        transcript: &'a mut Transcript,
        input_commitments: &Vec<CompressedRistretto>,
        output_commitments: &Vec<CompressedRistretto>,
    ) -> Result<(), R1CSError> {
        // Apply a domain separator with the shuffle parameters to the transcript
        let k = input_commitments.len();
        transcript.commit_bytes(b"dom-sep", b"ShuffleProof");
        transcript.commit_bytes(b"k", Scalar::from(k as u64).as_bytes());

        let mut verifier = Verifier::new(transcript);

        let input_vars: Vec<_> = input_commitments.iter().map(|commitment| {
            verifier.commit(*commitment)
        }).collect();

        let output_vars: Vec<_> = output_commitments.iter().map(|commitment| {
            verifier.commit(*commitment)
        }).collect();

        // Placeholder for gadget logic
        Self::gadget(&mut verifier, input_vars, output_vars)?;

        verifier.verify(&self.0, &pc_gens, &bp_gens)
    }

    // Placeholder for the gadget function
    fn gadget<CS: ConstraintSystem>
        (_cs: &mut CS, _input_vars: Vec<curve25519_dalek::ristretto::RistrettoComKey>,
         _output_vars: Vec<curve25519_dalek::ristretto::RistrettoComKey>)
        -> Result<(), R1CSError> {
        unimplemented!();
    }
}

fn main() {
// Construct generators. 1024 Bulletproofs generators is enough for 512-size shuffles.
let pc_gens = PedersenGens::default();
let bp_gens = BulletproofGens::new(1024, 1);

// Putting the prover code in its own scope means we can't
// accidentally reuse prover data in the test.
let (proof, in_commitments, out_commitments) = {
    let inputs = [
        Scalar::from(0u64),
        Scalar::from(1u64),
        Scalar::from(2u64),
        Scalar::from(3u64),
    ];
    let outputs = [
        Scalar::from(2u64),
        Scalar::from(3u64),
        Scalar::from(0u64),
        Scalar::from(1u64),
    ];

    let mut prover_transcript = Transcript::new(b"ShuffleProofTest");
    ShuffleProof::prove(
        &pc_gens,
        &bp_gens,
        &mut prover_transcript,
        &inputs,
        &outputs,
    )
    .expect("error during proving")
};

let mut verifier_transcript = Transcript::new(b"ShuffleProofTest");
let verification_result = proof.verify(&pc_gens, &bp_gens, &mut verifier_transcript, &in_commitments, &out_commitments);
assert!(verification_result.is_ok(), "{:?}", verification_result);
}

```

--------------------------------

### Rust Range Proof Example

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Demonstrates the generation and verification of a single-value range proof using the Bulletproofs library in Rust. It covers setting up generators, creating a transcript, proving a secret value within a specified bit range, and verifying the generated proof.

```rust
fn main() {
// Generators for Pedersen commitments.  These can be selected
// independently of the Bulletproofs generators.
let pc_gens = PedersenGens::default();

// Generators for Bulletproofs, valid for proofs up to bitsize 64
// and aggregation size up to 1.
let bp_gens = BulletproofGens::new(64, 1);

// A secret value we want to prove lies in the range [0, 2^32)
let secret_value = 1037578891u64;

// The API takes a blinding factor for the commitment.
let blinding = Scalar::random(&mut thread_rng());

// The proof can be chained to an existing transcript.
// Here we create a transcript with a doctest domain separator.
let mut prover_transcript = Transcript::new(b"doctest example");

// Create a 32-bit rangeproof.
let (proof, committed_value) = RangeProof::prove_single(
    &bp_gens,
    &pc_gens,
    &mut prover_transcript,
    secret_value,
    &blinding,
    32,
).expect("A real program could handle errors");

// Verification requires a transcript with identical initial state:
let mut verifier_transcript = Transcript::new(b"doctest example");
assert!(
    proof
        .verify_single(&bp_gens, &pc_gens, &mut verifier_transcript, &committed_value, 32)
        .is_ok()
);
}
```

--------------------------------

### Bulletproofs Internal Documentation Links

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Provides links to detailed internal documentation covering the theoretical underpinnings and implementation details of Bulletproofs, including range proofs, inner product proofs, and aggregation protocols.

```APIDOC
Internal Documentation:

- How Bulletproofs work: [bp_notes]
- How the range proof protocol works: [rp_notes]
- How the inner product proof protocol works: [ipp_notes]
- How the aggregation protocol works: [agg_notes]
- How the constraint system proofs work (under development)
- How the constraint system reduction works (under development)
- How the aggregated constraint system proofs work (future work)
```

--------------------------------

### Verifier Algorithm Overview

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/cs-proof.md

Describes the verifier's process, including the input it receives, how it builds constraints in two phases using Fiat-Shamir, and how it obtains necessary challenges.

```latex
Verifier’s algorithm
--------------------

The input to the verifier is the aggregated proof, which contains the \(m\) value commitments \(V_{(j)}\),
and \(32 \cdot (16 + 2 k)\) bytes of the proof data where \(k = \lceil \log_2(n) \rceil\) and \(n\) is a number of [multiplication gates](#multiplication-gates):

\[
  \{A_I', A_O', S', A_I'', A_O'', S'', T_1, T_3, T_4, T_5, T_6, t(x), {\tilde{t}}(x), \tilde{e}, L_k, R_k, \dots, L_1, R_1, a, b\}
\]

The verifier starts by adding all value commitments \(V_i\) to the protocol transcript.

The verifier then [builds constraints](#building-constraints) in two phases.

In the first phase, the verifier allocates \(n'\) multiplication gates and the first set of constraints without using challenges.

Then, the verifier uses the Fiat-Shamir transform to generate challenges required by the gadgets
by adding the intermediate commitments \(A_I', A_O', S'\) to the protocol transcript.

In the second phase, the verifier allocates additional \(n''\) multiplication gates and the second set of constraints,
providing necessary challenges to the gadgets that form the constraint system.

The verifier obtains more challenges by adding the appropriate data sequentially to the protocol transcript:
```

--------------------------------

### Rust Bulletproofs Implementation Snippet

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/aggregation-api.md

A Rust code snippet demonstrating the usage of the Bulletproofs library for generating and verifying zero-knowledge proofs. This example showcases a basic proof generation flow.

```rust
use bulletproofs::BulletproofGens;
use curve25519_dalek::scalar::Scalar;

fn main() {
    // Initialize parameters for Bulletproofs
    let n = 64; // Number of constraints
    let bp_gens = BulletproofGens::new(n, 1);

    // Example: Create a secret value and its commitment
    let secret_value = Scalar::from(123u64);
    // let commitment = bp_gens.commit(secret_value, &mut OsRng);

    // In a real scenario, you would construct a circuit and generate a proof here.
    // For demonstration, we'll just show the initialization.
    println!("Bulletproofs generator initialized with n = {}", n);
}
```

--------------------------------

### Performance Comparison of Rangeproof Implementations

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

Provides a comparative performance analysis of different Bulletproofs implementations for proving and verification of 64-bit rangeproofs on an Intel Skylake-X processor. It highlights speedups relative to other libraries.

```APIDOC
Comparative Performance (64-bit Rangeproof):

Environment: Intel Skylake-X i7-7800X (@3.5GHz, Turbo Boost disabled)
Times in microseconds (μs), lower is better.

| Implementation       | Group        | Proving (μs) | rel   | Verification (μs) | rel   |
|----------------------|--------------|-------------:|------:|------------------:|------:|
| ours (avx2)          | ristretto255 | 7300         | 1.00x | 1040              | 1.00x |
| ours (u64)           | ristretto255 | 11300        | 1.54x | 1490              | 1.43x |
| libsecp+endo         | secp256k1    | 14300        | 1.96x | 1900              | 1.83x |
| libsecp-endo         | secp256k1    | 16800        | 2.30x | 2080              | 2.00x |
| Monero               | ed25519 (unsafe)| 53300        | 7.30x | 4810              | 4.63x |

Note: Use of `curve25519-dalek` IFMA backend can provide further speedups (e.g., 3x verification over libsecp).
```

--------------------------------

### Run Rustfmt

Source: https://github.com/zkcrypto/bulletproofs/blob/main/CONTRIBUTING.md

Executes the `rustfmt` command to format the code according to the project's style guidelines. This command should be run within the `bulletproofs` repository directory.

```shell
cargo fmt
```

--------------------------------

### Bulletproofs Module Structure

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/notes-intro.md

This section outlines the organization of the Bulletproofs project, detailing the purpose of different modules and how they relate to each other. It highlights the separation between external API documentation and internal implementation details.

```rust
pub mod inner_product_proof;
pub mod range_proof;
pub mod r1cs_proof;

// Re-export types from modules to the crate root for external API
pub use inner_product_proof::InnerProductProof;
pub use range_proof::RangeProof;
pub use r1cs_proof::R1CSProof;

// FIXME Streamline module structure?
```

--------------------------------

### ShuffleProof Gadget Implementation

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/r1cs-docs-example.md

Provides the Rust implementation for the ShuffleProof gadget, including the `gadget` method for constraint system specification and the `prove` method for generating proofs.

```rust
# extern crate bulletproofs;
# extern crate curve25519_dalek;
# extern crate merlin;
# extern crate rand;
# 
# use bulletproofs::r1cs::*;
# use bulletproofs::{BulletproofGens, PedersenGens};
# use curve25519_dalek::ristretto::CompressedRistretto;
# use curve25519_dalek::scalar::Scalar;
# use merlin::Transcript;
# use rand::thread_rng;
# 
# // Shuffle gadget (documented in markdown file) 
# 
# /// A proof-of-shuffle.
# struct ShuffleProof(R1CSProof);
# 
# impl ShuffleProof {
#     fn gadget<CS: RandomizableConstraintSystem>(cs: &mut CS, x: Vec<Variable>, y: Vec<Variable>) -> Result<(),R1CSError> {
# 
#         assert_eq!(x.len(), y.len());
#         let k = x.len();
# 
#         if k == 1 {
#             cs.constrain(y[0] - x[0]);
#             return Ok(());
#         }
#
#         cs.specify_randomized_constraints(move |cs| {
#
#             let z = cs.challenge_scalar(b"shuffle challenge");
#
#             // Make last x multiplier for i = k-1 and k-2
#             let (_, _, last_mulx_out) = cs.multiply(x[k - 1] - z, x[k - 2] - z);
# 
#             // Make multipliers for x from i == [0, k-3]
#             let first_mulx_out = (0..k - 2).rev().fold(last_mulx_out, |prev_out, i| {
#                 let (_, _, o) = cs.multiply(prev_out.into(), x[i] - z);
#                 o
#             });
# 
#             // Make last y multiplier for i = k-1 and k-2
#             let (_, _, last_muly_out) = cs.multiply(y[k - 1] - z, y[k - 2] - z);
# 
#             // Make multipliers for y from i == [0, k-3]
#             let first_muly_out = (0..k - 2).rev().fold(last_muly_out, |prev_out, i| {
#                 let (_, _, o) = cs.multiply(prev_out.into(), y[i] - z);
#                 o
#             });
# 
#             // Constrain last x mul output and last y mul output to be equal
#             cs.constrain(first_mulx_out - first_muly_out);
#
#             Ok(())
#         })
#     }
# }
# 
# impl ShuffleProof {
#     /// Attempt to construct a proof that `output` is a permutation of `input`.
#     ///
#     /// Returns a tuple `(proof, input_commitments || output_commitments)`.
#     pub fn prove<'a, 'b>(
#         pc_gens: &'b PedersenGens,
#         bp_gens: &'b BulletproofGens,
#         transcript: &'a mut Transcript,
#         input: &[Scalar],
#         output: &[Scalar],
#     ) -> Result<(ShuffleProof, Vec<CompressedRistretto>, Vec<CompressedRistretto>), R1CSError> {
#         // Apply a domain separator with the shuffle parameters to the transcript
#         let k = input.len();
#         transcript.commit_bytes(b"dom-sep", b"ShuffleProof");
#         transcript.commit_bytes(b"k", Scalar::from(k as u64).as_bytes());
# 
#         let mut prover = Prover::new(&pc_gens, transcript);
# 
#         // Construct blinding factors using an RNG.
#         // Note: a non-example implementation would want to operate on existing commitments.
#         let mut blinding_rng = rand::thread_rng();
# 
#         let (input_commitments, input_vars): (Vec<_>, Vec<_>) = input.into_iter() 
#             .map(|v| {
#                 prover.commit(*v, Scalar::random(&mut blinding_rng))
#             })
#             .unzip();
# 
#         let (output_commitments, output_vars): (Vec<_>, Vec<_>) = output.into_iter()
#             .map(|v| {
#                 prover.commit(*v, Scalar::random(&mut blinding_rng))
#             })
#             .unzip();
#
#         ShuffleProof::gadget(&mut prover, input_vars, output_vars)?;
#

```

--------------------------------

### Bulletproofs Protocol Steps

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/notes-ipp.md

Summarizes the steps involved in the Bulletproofs protocol from the prover's and verifier's perspectives. It outlines the information transmitted at each stage and the final verification check.

```cryptography
Protocol Steps:
1. Prover transmits (L_j, R_j) for j = k down to 1.
2. Prover transmits final scalars (a^(0)_0, b^(0)_0).
3. Verifier checks the final relation directly.
```

--------------------------------

### Prover's Algorithm: Constructing Blinded Polynomials

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/cs-proof.md

Shows the construction of blinded polynomials, specifically the 'l(x)' polynomial, which incorporates left, right, and output wire assignments, along with blinding factors and weights. This is a key step in preparing for the inner product argument.

```LaTeX
\\begin{aligned}
  \\mathbf{l}}(x)  &\\gets (\\mathbf{a}\\_L' || \\mathbf{a}\\_L'') \\cdot x + (\\mathbf{s}\\_L' || \\mathbf{s}\\_L'') \\cdot x^3 + \\mathbf{y}^{-n} \\circ \\mathbf{w}\\_R \\cdot x + (\\mathbf{a}\\_O' || \\mathbf{a}\\_O'') \\cdot x^2 \\\\

```

--------------------------------

### Proof-of-Shuffle Constraint System Diagram

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/r1cs-docs-example.md

ASCII diagram illustrating the structure of multipliers used in the proof-of-shuffle constraint system for K > 1. It shows how inputs (x_i) and outputs (y_i) are combined with a challenge scalar (z) through a series of multiplications.

```ascii
        (x_0 - z)---⊗------⊗---(y_0 - z)        // mulx[0], muly[0]
                    |
        (x_1 - z)---⊗      ⊗---(y_1 - z)        // mulx[1], muly[1]
                    |
                   ...
                    |
    (x_{k-2} - z)---⊗      ⊗---(y_{k-2} - z)    // mulx[k-2], muly[k-2]
                   /
    (x_{k-1} - z)_
                                  \_(y_{k-1} - z)
```

--------------------------------

### Building Constraints in Bulletproofs

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/notes-r1cs.md

Details the process of dynamically building constraint systems in the Bulletproofs framework. It explains the operations available to a prover, such as allocating multipliers, adding constraints, and requesting challenge scalars.

```APIDOC
Building Constraints:
  - Prover commits to secret inputs (v) and obtains m variables.
  - Operations:
    1. Allocate a multiplier: Adds a new multiplication gate with low-level variables (a_L, a_R, a_O).
    2. Add a constraint: Encodes linear combinations into matrices (W_L, W_R, W_O, W_V) and constants (c).
    3. Request a challenge scalar: Returns a random scalar bound to committed high-level variables.
```

--------------------------------

### Bulletproofs Functionality Overview

Source: https://github.com/zkcrypto/bulletproofs/blob/main/README.md

This section outlines the core functionalities provided by the Bulletproofs library, including single-party range proofs, aggregated rangeproofs, multi-party computation, and a programmable constraint system API.

```APIDOC
Bulletproofs Library Features:

1. Single-party proofs of single or multiple ranges:
   - Implements the aggregated rangeproof construction.

2. Online multi-party computation (MPC) for rangeproof aggregation:
   - Uses session types to statically enforce correct protocol flow.

3. Programmable constraint system API (unstable, `yoloproofs` feature):
   - Expresses rank-1 constraint systems (R1CS).
   - Proves and verifies proofs of arbitrary statements.
   - Subject to change without notice and not covered by semver.

4. Online MPC for aggregated constraint system proofs (planned):
   - Future work item for the library.

5. Composition with other proofs:
   - Utilizes Merlin transcripts for arbitrary composition.
```

--------------------------------

### Bulletproofs Compression Step Breakdown

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/notes-ipp.md

Illustrates the mathematical breakdown of the Bulletproofs protocol, showing how terms are grouped and manipulated using indeterminate variables (u_k) to achieve compression. This section details the intermediate calculations for P_{k-1}, L_k, and R_k.

```mathematics
P_{k-1} = P_k + u^2_k \cdot L_k + u^{-2}_k \cdot R_k
L_k  = \langle \mathbf{a}_{\operatorname{lo}}, \mathbf{G}_{\operatorname{hi}} \rangle + \langle \mathbf{b}_{\operatorname{hi}}, \mathbf{H}_{\operatorname{lo}} \rangle + \langle \mathbf{a}_{\operatorname{lo}}, \mathbf{b}_{\operatorname{hi}} \rangle \cdot Q
R_k  = \langle \mathbf{a}_{\operatorname{hi}}, \mathbf{G}_{\operatorname{lo}} \rangle + \langle \mathbf{b}_{\operatorname{lo}}, \mathbf{H}_{\operatorname{hi}} \rangle + \langle \mathbf{a}_{\operatorname{hi}}, \mathbf{b}_{\operatorname{lo}} \rangle \cdot Q
```

--------------------------------

### ShuffleProof API Documentation

Source: https://github.com/zkcrypto/bulletproofs/blob/main/docs/r1cs-docs-example.md

API reference for the ShuffleProof struct, detailing its methods for proving and verifying permutation relationships between lists of scalars in a zero-knowledge manner.

```APIDOC
ShuffleProof:
  struct ShuffleProof(R1CSProof);

  impl ShuffleProof {
    /// Creates a new ShuffleProof gadget.
    /// This method defines the constraints for the shuffle proof.
    /// 
    /// # Arguments
    /// * `cs` - The constraint system to add constraints to.
    /// * `x` - A vector of variables representing the input scalars.
    /// * `y` - A vector of variables representing the output scalars.
    /// 
    /// # Returns
    /// `Ok(())` if the constraints are successfully added, `Err(R1CSError)` otherwise.
    fn gadget<CS: RandomizableConstraintSystem>(cs: &mut CS, x: Vec<Variable>, y: Vec<Variable>) -> Result<(), R1CSError>;

    /// Attempts to construct a proof that `output` is a permutation of `input`.
    /// This method is used by the prover.
    /// 
    /// # Arguments
    /// * `pc_gens` - Pedersen generators.
    /// * `bp_gens` - Bulletproofs generators.
    /// * `transcript` - The transcript for the proof.
    /// * `input` - A slice of scalars representing the input values.
    /// * `output` - A slice of scalars representing the output values.
    /// 
    /// # Returns
    /// A tuple containing the `ShuffleProof`, a vector of input commitments, and a vector of output commitments.
    /// Returns `Err(R1CSError)` if proof generation fails.
    pub fn prove<'a, 'b>(
        pc_gens: &'b PedersenGens,
        bp_gens: &'b BulletproofGens,
        transcript: &'a mut Transcript,
        input: &[Scalar],
        output: &[Scalar],
    ) -> Result<(ShuffleProof, Vec<CompressedRistretto>, Vec<CompressedRistretto>), R1CSError>;

    /// Verifies a ShuffleProof.
    /// This method is used by the verifier.
    /// 
    /// # Arguments
    /// * `pc_gens` - Pedersen generators.
    /// * `bp_gens` - Bulletproofs generators.
    /// * `transcript` - The transcript for the verification.
    /// * `input_commitments` - A slice of compressed Ristretto points representing the input commitments.
    /// * `output_commitments` - A slice of compressed Ristretto points representing the output commitments.
    /// 
    /// # Returns
    /// `Ok(bool)` where `true` indicates successful verification, `false` otherwise.
    /// Returns `Err(R1CSError)` if verification fails.
    pub fn verify<'a, 'b>(
        pc_gens: &'b PedersenGens,
        bp_gens: &'b BulletproofGens,
        transcript: &'a mut Transcript,
        input_commitments: &[CompressedRistretto],
        output_commitments: &[CompressedRistretto],
    ) -> Result<bool, R1CSError>;
  }

```
Tokens:
Raw