Module pedersen_range 

Pedersen range proof — prove that a Pedersen commitment opens to a value in [0, 2^bits) without revealing it.

This is the real sigma-protocol construction the advisory process specified, replacing the gated hash-based sketch: the prover decomposes the value into bits, commits to each bit, and produces a Cramer-Damgård-Schoenmakers OR-proof per bit that the bit commitment opens to 0 or to 1. verify takes the value commitment C as its statement and checks both the per-bit OR-proofs and the aggregation Σ 2^i·C_i == C.

Per-bit proof shape (branch k ∈ {0, 1}, statement C_i - k·G has a pure H-opening):

announcement  A_k = u_k·H
challenge     e_k
response      z_k = u_k + e_k·ρ_k
check         z_k·H == A_k + e_k·(C_i - k·G)

The real branch is proven honestly; the other is simulated with a random challenge, and the two challenges sum to the per-bit Fiat-Shamir challenge H("confium-range-v1" | C | i | C_i | A_0 | A_1), binding the whole transcript. Unaudited crate: see the lib docs — this construction follows the textbook composition but has had no external review.

Structs

PedersenCommitment

A Pedersen commitment together with its opening (prover-side).

PedersenGens

Generator pair for Pedersen commitments: C = v·G + r·H.

PedersenRangeProof

A non-interactive range proof for a Pedersen commitment.

Functions

commit

Commit value with a fresh random blinding.

prove

Prove that com opens to a value in [0, 2^bits).

verify

Verify a range proof against the value commitment c.