<commit_before>/**
 * @file       AccumulatorProofOfKnowledge.cpp
 *
 * @brief      AccumulatorProofOfKnowledge class for the Zerocoin library.
 *
 * @author     <NAME>, <NAME> and <NAME>
 * @date       June 2013
 *
 * @copyright  Copyright 2013 <NAME>, <NAME> and <NAME>
 * @license    This project is released under the MIT license.
 **/
// Copyright (c) 2017 The PIVX developers

#include "AccumulatorProofOfKnowledge.h"
#include "hash.h"

namespace libzerocoin {

AccumulatorProofOfKnowledge::AccumulatorProofOfKnowledge(const AccumulatorAndProofParams* p): params(p) {}

AccumulatorProofOfKnowledge::AccumulatorProofOfKnowledge(const AccumulatorAndProofParams* p,
        const Commitment& commitmentToCoin, const AccumulatorWitness& witness): params(p) {

	CBigNum sg = params->accumulatorPoKCommitmentGroup.g;
	CBigNum sh = params->accumulatorPoKCommitmentGroup.h;

	CBigNum g_n = params->accumulatorQRNCommitmentGroup.g;
	CBigNum h_n = params->accumulatorQRNCommitmentGroup.h;

	CBigNum e = commitmentToCoin.getContents();
	CBigNum r = commitmentToCoin.getRandomness();

	CBigNum aM_4 = params->accumulatorModulus/CBigNum((long)4);
    CBigNum aR = CBigNum(2).pow(params->k_prime + params->k_dprime);

    CBigNum r_1 = CBigNum::randBignum(aM_4);
    CBigNum r_2 = CBigNum::randBignum(aM_4);
    CBigNum r_3 = CBigNum::randBignum(aM_4);

	this->C_e = g_n.pow_mod(e, params->accumulatorModulus) * h_n.pow_mod(r_1, params->accumulatorModulus);
	this->C_u = witness.getValue() * h_n.pow_mod(r_2, params->accumulatorModulus);
	this->C_r = g_n.pow_mod(r_2, params->accumulatorModulus) * h_n.pow_mod(r_3, params->accumulatorModulus);

    CBigNum r_alpha = CBigNum::randBignum(params->maxCoinValue * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_alpha = 0-r_alpha;
	}

	CBigNum r_gamma = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_phi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_psi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_sigma = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_xi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);

    CBigNum r_epsilon =  CBigNum::randBignum(aM_4 * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_epsilon = 0-r_epsilon;
	}
    CBigNum r_eta = CBigNum::randBignum(aM_4 * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_eta = 0-r_eta;
	}
    CBigNum r_zeta = CBigNum::randBignum(aM_4 * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_zeta = 0-r_zeta;
	}

    CBigNum r_beta = CBigNum::randBignum(aM_4 * params->accumulatorPoKCommitmentGroup.modulus * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_beta = 0-r_beta;
	}
    CBigNum r_delta = CBigNum::randBignum(aM_4 * params->accumulatorPoKCommitmentGroup.modulus * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_delta = 0-r_delta;
	}

	this->st_1 = (sg.pow_mod(r_alpha, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_phi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
	this->st_2 = (((commitmentToCoin.getCommitmentValue() * sg.inverse(params->accumulatorPoKCommitmentGroup.modulus)).pow_mod(r_gamma, params->accumulatorPoKCommitmentGroup.modulus)) * sh.pow_mod(r_psi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
	this->st_3 = ((sg * commitmentToCoin.getCommitmentValue()).pow_mod(r_sigma, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_xi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;

	this->t_1 = (h_n.pow_mod(r_zeta, params->accumulatorModulus) * g_n.pow_mod(r_epsilon, params->accumulatorModulus)) % params->accumulatorModulus;
	this->t_2 = (h_n.pow_mod(r_eta, params->accumulatorModulus) * g_n.pow_mod(r_alpha, params->accumulatorModulus)) % params->accumulatorModulus;
	this->t_3 = (C_u.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;
	this->t_4 = (C_r.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_delta, params->accumulatorModulus)) * ((g_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;

	CHashWriter hasher(0,0);
	hasher << *params << sg << sh << g_n << h_n << commitmentToCoin.getCommitmentValue() << C_e << C_u << C_r << st_1 << st_2 << st_3 << t_1 << t_2 << t_3 << t_4;

	//According to the proof, this hash should be of length k_prime bits.  It is currently greater than that, which should not be a problem, but we should check this.
	CBigNum c = CBigNum(hasher.GetHash());
<commit_msg>aM_4 times aR stored<commit_after>/**
 * @file       AccumulatorProofOfKnowledge.cpp
 *
 * @brief      AccumulatorProofOfKnowledge class for the Zerocoin library.
 *
 * @author     <NAME>, <NAME> and <NAME>
 * @date       June 2013
 *
 * @copyright  Copyright 2013 <NAME>, <NAME> and <NAME>
 * @license    This project is released under the MIT license.
 **/
// Copyright (c) 2017 The PIVX developers

#include "AccumulatorProofOfKnowledge.h"
#include "hash.h"

namespace libzerocoin {

AccumulatorProofOfKnowledge::AccumulatorProofOfKnowledge(const AccumulatorAndProofParams* p): params(p) {}

AccumulatorProofOfKnowledge::AccumulatorProofOfKnowledge(const AccumulatorAndProofParams* p,
        const Commitment& commitmentToCoin, const AccumulatorWitness& witness): params(p) {

	CBigNum sg = params->accumulatorPoKCommitmentGroup.g;
	CBigNum sh = params->accumulatorPoKCommitmentGroup.h;

	CBigNum g_n = params->accumulatorQRNCommitmentGroup.g;
	CBigNum h_n = params->accumulatorQRNCommitmentGroup.h;

	CBigNum e = commitmentToCoin.getContents();
	CBigNum r = commitmentToCoin.getRandomness();

	CBigNum aM_4 = params->accumulatorModulus/CBigNum((long)4);
    CBigNum aR = CBigNum(2).pow(params->k_prime + params->k_dprime);
    CBigNum aR_t_aM_4 = aM_4 * aR;

    CBigNum r_1 = CBigNum::randBignum(aM_4);
    CBigNum r_2 = CBigNum::randBignum(aM_4);
    CBigNum r_3 = CBigNum::randBignum(aM_4);

	this->C_e = g_n.pow_mod(e, params->accumulatorModulus) * h_n.pow_mod(r_1, params->accumulatorModulus);
	this->C_u = witness.getValue() * h_n.pow_mod(r_2, params->accumulatorModulus);
	this->C_r = g_n.pow_mod(r_2, params->accumulatorModulus) * h_n.pow_mod(r_3, params->accumulatorModulus);

    CBigNum r_alpha = CBigNum::randBignum(params->maxCoinValue * aR);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_alpha = 0-r_alpha;
	}

	CBigNum r_gamma = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_phi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_psi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_sigma = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);
	CBigNum r_xi = CBigNum::randBignum(params->accumulatorPoKCommitmentGroup.modulus);

    CBigNum r_epsilon =  CBigNum::randBignum(aR_t_aM_4);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_epsilon = 0-r_epsilon;
	}
    CBigNum r_eta = CBigNum::randBignum(aR_t_aM_4);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_eta = 0-r_eta;
	}
    CBigNum r_zeta = CBigNum::randBignum(aR_t_aM_4);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_zeta = 0-r_zeta;
	}

    CBigNum r_beta = CBigNum::randBignum(aR_t_aM_4 * params->accumulatorPoKCommitmentGroup.modulus);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_beta = 0-r_beta;
	}
    CBigNum r_delta = CBigNum::randBignum(aR_t_aM_4 * params->accumulatorPoKCommitmentGroup.modulus);
	if(!(CBigNum::randBignum(CBigNum(3)) % 2)) {
		r_delta = 0-r_delta;
	}

	this->st_1 = (sg.pow_mod(r_alpha, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_phi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
	this->st_2 = (((commitmentToCoin.getCommitmentValue() * sg.inverse(params->accumulatorPoKCommitmentGroup.modulus)).pow_mod(r_gamma, params->accumulatorPoKCommitmentGroup.modulus)) * sh.pow_mod(r_psi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;
	this->st_3 = ((sg * commitmentToCoin.getCommitmentValue()).pow_mod(r_sigma, params->accumulatorPoKCommitmentGroup.modulus) * sh.pow_mod(r_xi, params->accumulatorPoKCommitmentGroup.modulus)) % params->accumulatorPoKCommitmentGroup.modulus;

	this->t_1 = (h_n.pow_mod(r_zeta, params->accumulatorModulus) * g_n.pow_mod(r_epsilon, params->accumulatorModulus)) % params->accumulatorModulus;
	this->t_2 = (h_n.pow_mod(r_eta, params->accumulatorModulus) * g_n.pow_mod(r_alpha, params->accumulatorModulus)) % params->accumulatorModulus;
	this->t_3 = (C_u.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;
	this->t_4 = (C_r.pow_mod(r_alpha, params->accumulatorModulus) * ((h_n.inverse(params->accumulatorModulus)).pow_mod(r_delta, params->accumulatorModulus)) * ((g_n.inverse(params->accumulatorModulus)).pow_mod(r_beta, params->accumulatorModulus))) % params->accumulatorModulus;

	CHashWriter hasher(0,0);
	hasher << *params << sg << sh << g_n << h_n << commitmentToCoin.getCommitmentValue() << C_e << C_u << C_r << st_1 << st_2 << st_3 << t_1 << t_2 << t_3 << t_4;

	//According to the proof, this hash should be of length k_prime bits.  It is currently greater than that, which should not be a problem, but we should check this.
	CBigNum c = CBigNum(hasher.GetHash());

{'fraction_non_alphanumeric': 0.1371051001445385, 'fraction_numerical': 0.013524674788354327, 'mean_word_length': 6.229104477611941, 'pattern_counts': {'":': 0, '<': 79, '<?xml version=': 0, '>': 127, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3623964', 'n_tokens_mistral': 3907, 'n_tokens_neox': 3746, 'n_words': 542}